Replace with new image

* Update snake.md

Updated malware behaviors and descriptions.

* Update snake.md

Divided table to split out enhanced techniques

* Update software-packing.md

Added Snake

* Update self-deletion.md

Added Snake

* Update system-information-discovery.md

Added Snake

* Update keylogging.md

Added Snake

* Update screen-capture.md

* Update decode-data.md

Added Snake

* Update decrypt-data.md

Added Snake

* Update copy-file.md

Added Snake

* Update create-file.md

Added Snake

* Update delete-file.md

* Update crypto-library.md

Added Snake

* Update crypto-library.md

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>

README.md

@@ -130,7 +130,7 @@ The table below lists MBC behaviors and related ATT&CK techniques. In most cases
 |**B0031**|COMMAND AND CONTROL|**Domain Name Generation**|Dynamic Resolution: Domain Name Generation ([T1568.002](https://attack.mitre.org/techniques/T1568/002))|
 |**B0032**|ANTI-STATIC ANALYSIS|**Executable Code Obfuscation**|*none*|
 |**B0033**|IMPACT|**Denial of Service**|Network Denial of Service ([T1498](https://attack.mitre.org/techniques/T1498))|
-|**B0034**|ANTI-STATIC ANALYSIS|**Executable Code Obfuscation**|*none*|
+|**B0034**|ANTI-STATIC ANALYSIS|**Executable Code Optimization**|*none*|
 |**B0035**|PERSISTENCE|**Shutdown Event**|*none*|
 |**B0036**|ANTI-BEHAVIORAL ANALYSIS|**Capture Evasion**|*none*|
 |**B0037**|DEFENSE EVASION|**Bypass Data Execution Prevention**|*none*|

anti-behavioral-analysis/virtual-machine-detection.md

@@ -17,7 +17,7 @@
 </tr>
 <tr>
 <td><b>Version</b></td>
-<td><b>2.3</b></td>
+<td><b>2.4</b></td>
 </tr>
 <tr>
 <td><b>Created</b></td>
@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>27 April 2024</b></td>
+<td><b>27 December 2024</b></td>
 </tr>
 </table>
 
@@ -59,6 +59,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |**Check Windows - Title bars**|B0009.022|Malware may check windows for VM-related characteristics. May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
 |**Check Windows - Unique windows**|B0009.021|Malware may check windows for VM-related characteristics. May check for the presence of known windows from analysis tools running in a VM.|
 |**Check Windows - Window size**|B0009.020|Malware may check windows for VM-related characteristics. Tiny window size may indicate a VM.|
+|**Check Username or Hostname**|B0009.039|Malware checks for hostnames or session usernames that indicate the use of a virtual machine.|
 |**Guest Process Testing**|B0009.010|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
 |**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
 |**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|

anti-static-analysis/disassembler-evasion.md

@@ -17,7 +17,7 @@
 </tr>
 <tr>
 <td><b>Version</b></td>
-<td><b>2.2</b></td>
+<td><b>2.3</b></td>
 </tr>
 <tr>
 <td><b>Created</b></td>
@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 February 2024</b></td>
+<td><b>27 December 2024</b></td>
 </tr>
 </table>
 
@@ -40,6 +40,8 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented
 |**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
 |**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; may be identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
 |**Desynchronizing Opaque Predicates**|B0012.006|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[6]](#6) This method is related to Unprotect technique U0201.|
+|**Fake Function**|B0012.007|A fake function call is used to call an address which confuses a disassembler and results in incorrect disassembly. Manually undefining the function call can enable the disassembler to produce the true code.|
+|**pusha/popa Sequence**|B0012.008|Malware uses excessive pusha and popa instructions to confuse disassemblers.|
 |**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[4]](#4) for an analysis of a VBA-Stomped malicious VBA Office document. See [[5]](#5) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
 |**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often in the same basic block or function.|
 

anti-static-analysis/software-packing.md

@@ -63,6 +63,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 |[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet has the option to compress its payload using UPX or MPRESS.  [[6]](#6)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware has a custom packer to obfuscate itself. [[7]](#7)|
 |[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads. [[8]](#8)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake is distributed in a packed format. [[9]](#9)|
 
 ## Detection
 
@@ -88,6 +89,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 |[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)|--|
 |[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)|--|
 |[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)|--|
+|[packed with nmm-protect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nmm-protect/packed-with-nmm-protect.yml)|Software Packing::VMProtect (F0001.010)|--|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|
@@ -134,3 +136,5 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 
 <a name="8">[8]</a> https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf
 
+<a name="9">[9]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

collection/archive-collected-data.md

@@ -37,11 +37,11 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org
 |Name|ID|Description|
 |---|---|---|
 |**Encoding**|E1560.m01|Data is encoded.|
-|**Encoding - Custom Encoding**|E1560.m04|Data is encoded. A custom algorithm is used to encode the exfiltrated data.|
-|**Encoding - Standard Encoding**|E1560.m03|Data is encoded. A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
+|**Encoding - Custom Algorithm**|E1560.m04|Data is encoded. A custom algorithm is used to encode the exfiltrated data.|
+|**Encoding - Standard Algorithm**|E1560.m03|Data is encoded. A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
 |**Encryption**|E1560.m02|Data is encrypted.|
-|**Encryption - Custom Encryption**|E1560.m06|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.|
-|**Encryption - Standard Encryption**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
+|**Encryption - Custom Algorithm**|E1560.m06|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.|
+|**Encryption - Standard Algorithm**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
 
 ## Use in Malware
 

collection/keylogging.md

@@ -56,6 +56,7 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
 |[**Redhip**](../xample-malware/redhip.md)|2011|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Snake**](../xample-malware/snake.md)|2004|F0002.001|Malware logs keystrokes via application hook. [[10]](#10)|
 
 ## Detection
 
@@ -104,3 +105,5 @@ setnz   al      ; if the previous condition is not met (the zero flag is 1), a 1
 
 <a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="10">[10]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

collection/screen-capture.md

@@ -49,6 +49,7 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|E1113.m01|Malware captures screenshots. [[5]](#5)|
 |[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Malware captures screenshots. [[5]](#5)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Malware captures screenshots. [[5]](#5)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Malware captures screenshots. [[6]](#6)|
 
 ## Detection
 
@@ -96,3 +97,5 @@ call    dword ptr [->GDI32.DLL::BitBlt] ; Windows API function to transfer a rec
 
 <a name="5">[5]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="6">[6]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

defense-evasion/disable-or-evade-security-tools.md

@@ -67,6 +67,7 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta
 |[protect spawned processes with mitigation policies](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|UpdateProcThreadAttribute|
 |[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|--|
 |[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)|--|
+|[overwrite DLL .text section to remove hooks](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/overwrite-dll-text-section-to-remove-hooks.yml)|Disable or Evade Security Tools (F0004)|GetModuleHandle, GetModuleHandleEx|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|

defense-evasion/hijack-execution-flow.md

@@ -71,7 +71,7 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)|--|
-|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats|
+|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|AddPropSheetPageProc, CallWindowProc, CertEnumSystemStore, CertEnumSystemStoreLocator, CreateTimerQueueTimer, CryptEnumOIDInfo, DPA_Create, DPA_SetPtr, DPA_EnumCallback, DSA_Create, DSA_InsertItem, DSA_EnumCallback, DrawState, EnumCalendarInfo, EnumCalendarInfoEx, EnumDateFormats, GrayString, ImmEnumInputContext, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumDirTree, EnumDisplayMonitors, EnumFontFamilies, EnumFontFamiliesEx, EnumFonts, EnumLanguageGroupLocales, GetDC, GetDCEx, EnumObjects, EnumProps, EnumPropsEx, EnumPwrSchemes, EnumResourceTypes, EnumSystemCodePages, EnumSystemGeoID, EnumSystemGeoNames, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumWindowsStations, EnumerateLoadedModules, EnumTimeFormats, SymInitialize, SymEnumProcesses, SymRegisterCallback, VerifierEnumerateResource|
 |[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress|
 
 |Tool: CAPE|Mapping|APIs|

defense-evasion/modify-registry.md

@@ -79,7 +79,7 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
 |[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|Modify Registry (E1112)|--|
 |[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Modify Registry (E1112)|--|
 |[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Modify Registry (E1112)|--|
-|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
+|[neshta_regkeys](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
 |[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey|
 |[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Modify Registry (E1112)|--|
 |[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|

defense-evasion/obfuscated-files-or-information.md

@@ -47,11 +47,11 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |Name|ID|Description|
 |---|---|---|
 |**Encoding**|E1027.m01|A malware sample, file, or other information is encoded. This method is related to the subsequently defined ATT&CK sub-technique **Encrypted/Encoded File ([T1027.013](https://attack.mitre.org/techniques/T1027/013/))**.|
-|**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information. This method is related to Unprotect technique U0702.|
-|**Encoding-Standard Algorithm**|[E1027.m02](#e1027m02-snippet)|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information. This method is related to Unprotect technique U0701 and U0706.|
+|**Encoding - Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information. This method is related to Unprotect technique U0702.|
+|**Encoding - Standard Algorithm**|[E1027.m02](#e1027m02-snippet)|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information. This method is related to Unprotect technique U0701 and U0706.|
 |**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted. This method is related to Unprotect technique U0703 and to the subsequently defined ATT&CK sub-technique **Encrypted/Encoded File ([T1027.013](https://attack.mitre.org/techniques/T1027/013/))**.|
-|**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
-|**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information. This method is related to Unprotect technique U0701.|
+|**Encryption - Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
+|**Encryption - Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information. This method is related to Unprotect technique U0701.|
 |**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.|
 |**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|
 
@@ -106,6 +106,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
 |[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
 |[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptImportKey, CryptAcquireContext, CryptEncrypt|
+|[encrypt data using RC4 via SystemFunction033](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|SystemFunction033|
 |[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
 |[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
 |[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|

defense-evasion/process-injection.md

@@ -100,7 +100,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
 |[transacted_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|NtRollbackTransaction, NtMapViewOfSection, RtlSetCurrentTransaction|
 |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--|
 |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--|
-|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_silent_process_exit.py)|Process Injection (E1055)|--|
+|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--|
 |[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
 |[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_shim.py)|Process Injection::Injection using Shims (E1055.m03)|--|
 |[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_runpe.py)|Process Injection (E1055)|--|

defense-evasion/self-deletion.md

@@ -48,12 +48,14 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 |[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[2]](#2)|
 |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)|
 |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[4]](#4)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake can delete itself. [[5]](#5)|
 
 ## Detection
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)|--|
+|[self delete using alternate data streams](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)|Defense Evasion::Self Deletion (F0007)|SetFileInformationByHandle, kernel32.SetFileInformationByHandle|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|
@@ -69,4 +71,6 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 
 <a name="3">[3]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
 
-<a name="4">[4]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
+<a name="4">[4]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
+
+<a name="5">[5]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

discovery/system-information-discovery.md

@@ -62,6 +62,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik gets the disk size. [[9]](#9)|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)|
 |[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake gets the OS version, disk size, machine name, and geographic location [[11]](#11)|
 
 ## Detection
 
@@ -69,7 +70,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
 |---|---|---|
 |[query environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/query-environment-variable.yml)|System Information Discovery (E1082)|kernel32.GetEnvironmentVariable, kernel32.GetEnvironmentStrings, kernel32.ExpandEnvironmentStrings, msvcr90.getenv, msvcrt.getenv, System.Environment::GetEnvironmentVariable, System.Environment::GetEnvironmentVariables, System.Environment::ExpandEnvironmentVariables|
 |[get disk information](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-information.yml)|System Information Discovery (E1082)|kernel32.GetDriveType, kernel32.GetLogicalDrives, kernel32.GetVolumeInformation, kernel32.GetVolumeNameForVolumeMountPoint, kernel32.GetVolumePathNamesForVolumeName, kernel32.GetLogicalDriveStrings, kernel32.QueryDosDevice|
-|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx, DeviceIoControl|
+|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx|
 |[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)|--|
 |[get hostname](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/hostname/get-hostname.yml)|System Information Discovery (E1082)|kernel32.GetComputerName, kernel32.GetComputerNameEx, GetComputerObjectName, ws2_32.gethostname, gethostname|
 
@@ -135,3 +136,5 @@ call    dword ptr [->KERNEL32.DLL::GetEnvironmentVariableW]     ; call function
 <a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
 <a name="10">[10]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="11">[11]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

execution/exploitation-for-client-execution.md

@@ -67,8 +67,8 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or
 |[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory|
 |[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateFile|
 |[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW|
-|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
-|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
+|[uses_windows_utilities](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
+|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
 |[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
 |[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll|
 |[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2015_2419.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|

impact/disk-wipe.md

@@ -46,6 +46,7 @@ This description refines the ATT&CK **Disk Wipe: Disk Content Wipe ([T1561.001](
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[overwrite Master Boot Record (MBR)](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml)|Disk Wipe (F0014)|kernel32.WriteFile|
+|[delete drive layout via IOCTL](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/delete-drive-layout-via-ioctl.yml)|Disk Wipe (F0014)|--|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|

mbc_summary.md

@@ -139,7 +139,6 @@
 |C0001|**[Socket Communication](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/socket-communication.md)**|COMMUNICATION|
 |C0009|**[Stack Pivot](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/memory/stack-pivot.md)**|MEMORY|
 |C0055|**[Suspend Thread](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/suspend-thread.md)**|PROCESS|
-|C0022|**[Synchronization](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/synchronization.md)**|PROCESS|
 |C0018|**[Terminate Process](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/terminate-process.md)**|PROCESS|
 |C0039|**[Terminate Thread](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/terminate-thread.md)**|PROCESS|
 |C0070|**[Unmap Section View](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/unmap-section-view.md)**|PROCESS|

micro-behaviors/communication/dns-communication.md

@@ -52,18 +52,18 @@ The DNS Communication micro-behavior focuses on DNS communication.
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[reference DNS over HTTPS endpoints](https://github.com/mandiant/capa-rules/blob/master/communication/dns/reference-dns-over-https-endpoints.yml)|DNS Communication::Server Connect (C0011.002)|--|
-|[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, getaddrinfo, GetAddrInfo, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses|
+|[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, GetAddrInfo, GetAddrInfoW, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[network_dns_blockchain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_blockchain.py)|DNS Communication (C0011)|--|
-|[network_dns_idn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_idn.py)|DNS Communication (C0011)|DnsQueryA|
-|[network_dns_opennic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_opennic.py)|DNS Communication (C0011)|--|
-|[network_dns_reverse_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_reverse_proxy.py)|DNS Communication (C0011)|--|
-|[network_dns_suspicious_querytype](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_suspicious_querytype.py)|DNS Communication (C0011)|DnsQueryA|
-|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_tunneling_request.py)|DNS Communication (C0011)|DnsQuery_A, DnsQuery_W|
-|[network_dns_doh_tls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_doh_tls.py)|DNS Communication (C0011)|--|
-|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|DNS Communication (C0011)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[network_dns_blockchain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSBlockChain|DNS Communication (C0011)|--|
+|[network_dns_idn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSIDN|DNS Communication (C0011)|DnsQueryA|
+|[network_dns_opennic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSOpenNIC|DNS Communication (C0011)|--|
+|[network_dns_reverse_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSReverseProxy|DNS Communication (C0011)|--|
+|[network_dns_suspicious_querytype](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSSuspiciousQueryType|DNS Communication (C0011)|DnsQueryA|
+|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSTunnelingRequest|DNS Communication (C0011)|DnsQuery_A, DnsQuery_W|
+|[network_dns_doh_tls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDOHTLS|DNS Communication (C0011)|--|
+|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_dga.py)|NetworkDGA|DNS Communication (C0011)| --|
 
 ### C0011.001 Snippet
 <details>

micro-behaviors/communication/http-communication.md

@@ -94,31 +94,30 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |[connect to HTTP server](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-http-server.yml)|HTTP Communication::Connect to Server (C0002.009)|wininet.InternetConnect|
 |[extract HTTP body](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/extract-http-body.yml)|HTTP Communication::Extract Body (C0002.011)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|HTTP Communication (C0002)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
-|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|HTTP Communication (C0002)|--|
-|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|HTTP Communication::Send Request (C0002.003)|--|
-|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|HTTP Communication (C0002)|--|
-|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|HTTP Communication::Send Data (C0002.005)|--|
-|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_cnc_http.py)|HTTP Communication (C0002)|--|
-|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|HTTP Communication (C0002)|HttpOpenRequestA, HttpSendRequestA|
-|[network_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_http.py)|HTTP Communication (C0002)|--|
-|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/explorer_http.py)|HTTP Communication (C0002)|WinHttpConnect, WinHttpOpenRequest|
-|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|HTTP Communication (C0002)|--|
-|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|HTTP Communication::Send Data (C0002.005)|--|
-|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|HTTP Communication (C0002)|--|
-|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|HTTP Communication::Send Data (C0002.005)|--|
-|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_athenahttp.py)|HTTP Communication (C0002)|--|
-|[koadic_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/koadic_network_activity.py)|HTTP Communication (C0002)|HttpOpenRequestW, WinHttpOpenRequest|
-|[http_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/http_request.py)|HTTP Communication (C0002)|HttpOpenRequestA, HttpOpenRequestW, InternetConnectW, InternetOpenUrlA, InternetConnectA, InternetOpenUrlW, WinHttpGetProxyForUrl|
-|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_http_link.py)|HTTP Communication (C0002)|--|
-|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_reversed_http_link.py)|HTTP Communication (C0002)|--|
-|[https_urls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/https_urls.py)|HTTP Communication (C0002)|InternetOpenUrlW, InternetOpenUrlA|
-|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_http.py)|HTTP Communication (C0002)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile|
-|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_url.py)|HTTP Communication (C0002)|--|
-|[downloads_from_filehosting](https://github.com/CAPESandbox/community/tree/master/modules/signatures/downloads_from_filehosting.py)|HTTP Communication (C0002)|WinHttpOpenRequest, InternetOpenUrlA|
-|[purplewave_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_network_activity.py)|HTTP Communication (C0002)|InternetOpenW, HttpOpenRequestW, HttpSendRequestW, HttpAddRequestHeadersA|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/internet_dropper.py)|Internet_Dropper|HTTP Communication (C0002)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
+|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_madness.py)|Madness|HTTP Communication (C0002)|--|
+|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_madness.py)|Madness|HTTP Communication::Send Request (C0002.003)|--|
+|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive.py)|Drive|HTTP Communication (C0002)|--|
+|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive.py)|Drive|HTTP Communication::Send Data (C0002.005)|--|
+|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_cnc_http.py)|NetworkCnCHTTP|HTTP Communication (C0002)|--|
+|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_beacon.py)|Recon_Beacon|HTTP Communication (C0002)|HttpOpenRequestA, HttpSendRequestA|
+|[network_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_http.py)|NetworkHTTP|HTTP Communication (C0002)|--|
+|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_explorer.py)|ExplorerHTTP|HTTP Communication (C0002)|WinHttpConnect, WinHttpOpenRequest|
+|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive2.py)|Drive2|HTTP Communication (C0002)|--|
+|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive2.py)|Drive2|HTTP Communication::Send Data (C0002.005)|--|
+|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_dirtjumper.py)|DirtJumper|HTTP Communication (C0002)|--|
+|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_dirtjumper.py)|DirtJumper|HTTP Communication::Send Data (C0002.005)|--|
+|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_athenahttp.py)|AthenaHttp|HTTP Communication (C0002)|--|
+|[koadic_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/exploitation_framework_koadic.py)|KoadicNetworkActivity|HTTP Communication (C0002)|WinHttpOpenRequest, HttpOpenRequestW|
+|[http_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/http_request.py)|HTTP_Request|HTTP Communication (C0002)|HttpOpenRequestA, HttpOpenRequestW, InternetConnectW, InternetOpenUrlA, InternetConnectA, InternetOpenUrlW, WinHttpGetProxyForUrl|
+|[cmdline_http_link](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/cmdline_anomaly.py)|CommandLineHTTPLink|HTTP Communication (C0002)|--|
+|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/cmdline_anomaly.py)|CommandLineReversedHTTPLink|HTTP Communication (C0002)|--|
+|[network_docfile_http](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/network_docfile_http.py)|NetworkDocumentHTTP|HTTP Communication (C0002)|InternetCrackUrlW, InternetCrackUrlA, URLDownloadToFileW, HttpOpenRequestW, InternetReadFile, WSASend|
+|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/banker_zeus_url.py)|ZeusURL|HTTP Communication (C0002)|--|
+|[downloads_from_filehosting](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/filehostings.py)|Modiloader_APIs|HTTP Communication (C0002)|InternetOpenUrlA, WinHttpOpenRequest|
+|[purplewave_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_purplewave.py)|PurpleWaveNetworkAcivity|HTTP Communication (C0002)|InternetOpenW, HttpAddRequestHeadersA, HttpSendRequestW, HttpOpenRequestW|
 
 ### C0002.017 Snippet
 <details>

micro-behaviors/communication/icmp-communication.md

@@ -43,7 +43,7 @@ This micro-behavior is related to ICMP communication.
 |---|---|---|
 |[send ICMP echo request](https://github.com/mandiant/capa-rules/blob/master/communication/icmp/send-icmp-echo-request.yml)|ICMP Communication::Echo Request (C0014.002)|IcmpSendEcho, IcmpSendEcho2, IcmpSendEcho2Ex, Icmp6SendEcho2, IcmpCreateFile, Icmp6CreateFile, IcmpCloseHandle|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[suspicious_ping_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_ping_use.py)|ICMP Communication (C0014)|--|
-|[network_icmp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_icmp.py)|ICMP Communication (C0014)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[network_icmp](https://github.com/CAPESandbox/community/blob/master/modules/signatures/all/network_icmp.py)|NetworkICMP|ICMP Communication (C0014)|--|
+|[suspicious_ping_use](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|SuspiciousPingUse|ICMP Communication (C0014)|--|

micro-behaviors/communication/interprocess-communication.md

@@ -59,10 +59,10 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
 |[connect pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/connect/connect-pipe.yml)|Interprocess Communication::Connect Pipe (C0003.002)|kernel32.ConnectNamedPipe, kernel32.CallNamedPipe, System.IO.Pipes.NamedPipeClientStream::Connect, System.IO.Pipes.NamedPipeClientStream::ConnectAsync|
 |[read pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/read/read-pipe.yml)|Interprocess Communication::Read Pipe (C0003.003)|kernel32.PeekNamedPipe, kernel32.ReadFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication (C0003)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
-|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ipc_namedpipe.py)|IPC_NamedPipe|Interprocess Communication (C0003)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
+|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ipc_namedpipe.py)|IPC_NamedPipe|Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
 
 ### C0003.002 Snippet
 <details>

micro-behaviors/communication/smtp-communication.md

@@ -39,7 +39,7 @@ This micro-behavior focuses on SMTP communication.
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[network_smtp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_smtp.py)|SMTP Communication (C0012)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[network_smtp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_smtp.py)|NetworkSMTP|SMTP Communication (C0012)|--|
 

micro-behaviors/communication/socket-communication.md

@@ -69,26 +69,27 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |---|---|---|
 |[start TCP server](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/serve/start-tcp-server.yml)|Socket Communication::Start TCP Server (C0001.005)|listen, accept, WSAAccept, System.Net.Sockets.TcpListener::Start, System.Net.Sockets.TcpListener::AcceptTcpClient, System.Net.Sockets.TcpListener::BeginAcceptTcpClient, System.Net.Sockets.TcpListener::AcceptTcpClientAsync, System.Net.Sockets.TcpListener::AcceptSocket, System.Net.Sockets.TcpListener::BeginAcceptSocket, System.Net.Sockets.TcpListener::AcceptSocketAsync|
 |[act as TCP client](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/client/act-as-tcp-client.yml)|Socket Communication::TCP Client (C0001.008)|System.Net.Sockets.TcpClient::ctor|
-|[get socket status](https://github.com/mandiant/capa-rules/blob/master/communication/socket/get-socket-status.yml)|Socket Communication::Get Socket Status (C0001.012)|ws2_32.select|
-|[create raw socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-raw-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, ws2_32.WSASocketA|
-|[set socket configuration](https://github.com/mandiant/capa-rules/blob/master/communication/socket/set-socket-configuration.yml)|Socket Communication::Set Socket Config (C0001.001)|ws2_32.setsockopt, ws2_32.ioctlsocket|
+|[get socket status](https://github.com/mandiant/capa-rules/blob/master/communication/socket/get-socket-status.yml)|Socket Communication::Get Socket Status (C0001.012)|select, ws2_32.select|
+|[create raw socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-raw-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, ws32_32.WSASocket, WSASocketA, WSASocketW|
+|[set socket configuration](https://github.com/mandiant/capa-rules/blob/master/communication/socket/set-socket-configuration.yml)|Socket Communication::Set Socket Config (C0001.001)|ws2_32.setsockopt, ws2_32.ioctlsocket, setsockopt, ioctlsocket|
 |[create VMCI socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-vmci-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, DeviceIoControl, socket, ioctl|
-|[initialize Winsock library](https://github.com/mandiant/capa-rules/blob/master/communication/socket/initialize-winsock-library.yml)|Socket Communication::Initialize Winsock Library (C0001.009)|ws2_32.WSAStartup|
-|[connect TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/connect-tcp-socket.yml)|Socket Communication::Connect Socket (C0001.004)|connect, ws2_32.connect, ws2_32.WSAConnect, ConnectEx, WSAIoctl, setsockopt, bind|
-|[create TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket.yml)|Socket Communication::Create TCP Socket (C0001.011)|ws2_32.socket, ws2_32.WSASocket, socket|
+|[initialize Winsock library](https://github.com/mandiant/capa-rules/blob/master/communication/socket/initialize-winsock-library.yml)|Socket Communication::Initialize Winsock Library (C0001.009)|ws2_32.WSAStartup, WSAStartup|
+|[connect TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/connect-tcp-socket.yml)|Socket Communication::Connect Socket (C0001.004)|connect, ws2_32.connect, ws2_32.WSAConnect, WSAConnect, ConnectEx, ws2_32.WSAIoctl, WSAIoctl, setsockopt, bind|
+|[create TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket.yml)|Socket Communication::Create TCP Socket (C0001.011)|ws2_32.socket, ws2_32.WSASocket, socket, WSASocketA, WSASocketW, System.Net.Sockets.Socket::ctor|
 |[create TCP socket via raw AFD driver](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml)|Socket Communication::Create TCP Socket (C0001.011)|kernel32.CreateEvent, NtCreateFile, NtDeviceIoControlFile, kernel32.WaitForSingleObject|
 |[obtain TransmitPackets callback function via WSAIoctl](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml)|Socket Communication::Send TCP Data (C0001.014)|WSAIoctl, WSAGetLastError|
 |[send TCP data via WFP API](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/send-tcp-data-via-wfp-api.yml)|Socket Communication::Send TCP Data (C0001.014)|fwpkclnt.FwpsStreamInjectAsync0|
-|[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor|
-|[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send|
-|[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom|
+|[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, WSASocketA, WSASocketW, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor|
+|[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, sendto, WSASend, WSASendTo, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send|
+|[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, WSARecv, WSARecvDisconnect, WSARecvFrom, recvmsg, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom|
+|[attach BPF to socket on Linux](https://github.com/mandiant/capa-rules/blob/master/communication/socket/attach-bpf-to-socket-on-linux.yml)|Socket Communication::Set Socket Config (C0001.001)|setsockopt|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[network_excessive_udp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_excessive_udp.py)|Socket Communication (C0001)|--|
-|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_network_activity.py)|Socket Communication (C0001)|send|
-|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Socket Communication (C0001)|send|
-|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|Socket Communication (C0001)|listen, bind|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[network_excessive_udp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_excessive_udp.py)|NetworkExcessiveUDP|Socket Communication (C0001)|--|
+|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_bind.py)|NetworkBIND|Socket Communication (C0001)|listen, bind|
+|[blackrat_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_blackremote.py)|BlackRATNetworkActivity|Socket Communication (C0001)|send|
+|[obliquerat_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_oblique.py)|ObliquekRATNetworkActivity|Socket Communication (C0001)|send|
 
 ### C0001.009 Snippet
 <details>

micro-behaviors/communication/wininet.md

@@ -44,9 +44,12 @@ The methods below are those of most interest in malware analysis. Details can be
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|WinINet (C0005)|InternetOpenA, InternetOpenUrlA|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[nemty_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNetworkActivity|WinINet (C0005)|InternetOpenA, InternetOpenUrlA|
+|[nemty_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNetworkActivity|WinINet::InternetOpen (C0005.002)|InternetOpenA|
+|[nemty_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNetworkActivity|WinINet::InternetOpenURL (C0005.003)|InternetOpenUrlA|
+|[powershell_network_connection](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/powershell_command.py)|PowerShellNetworkConnection|WinINet (C0005)|InternetCrackUrlW, InternetCrackUrlA|
 
 ### C0005.001 Snippet
 <details>

micro-behaviors/cryptography/crypto-library.md

@@ -37,6 +37,12 @@ Malware uses a crypto library.
 |**API Call**|C0059.001|Malware uses crypto API calls.|
 |**Static Public Library**|C0059.002|A public crypto library is embedded in the code.|
 
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../../xample-malware/snake.md)|2004|C0059.001|Snake uses API calls to interface with cryptographic libraries. [[1]](#1)|
+
 ## Detection
 
 |Tool: capa|Mapping|APIs|
@@ -46,3 +52,7 @@ Malware uses a crypto library.
 |[linked against OpenSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/openssl/linked-against-openssl.yml)|Crypto Library (C0059)|--|
 |[linked against PolarSSL/mbed TLS](https://github.com/mandiant/capa-rules/blob/master/linking/static/polarssl/linked-against-polarsslmbed-tls.yml)|Crypto Library (C0059)|--|
 |[linked against wolfSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfssl/linked-against-wolfssl.yml)|Crypto Library (C0059)|--|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

micro-behaviors/cryptography/decrypt-data.md

@@ -54,7 +54,9 @@ Malware may decrypt data.
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
-|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt [[1]](#1)|
+|[**Snake**](../../xample-malware/snake.md)|2004|C0031.001|Decrypts credential stores using AES [[2]](#2)|
+|[**Snake**](../../xample-malware/snake.md)|2004|C0031.005|Decrypts .NET assembly with 3DES [[2]](#2)|
 
 ## Detection
 
@@ -63,9 +65,9 @@ Malware may decrypt data.
 |[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Decrypt Data (C0031)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey|
 |[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decrypt Data (C0031)|CryptDecrypt|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Decryption|Decrypt Data (C0031)|CryptDecrypt|
 
 ## Code Snippets
 
@@ -129,3 +131,5 @@ retn
 
 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="2">[2]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

micro-behaviors/cryptography/encrypt-data.md

@@ -86,7 +86,7 @@ Malware may encrypt data.
 |[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Encrypt Data::Sosemanuk (C0027.008)|--|
 |[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Encrypt Data::Camellia (C0027.003)|--|
 |[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Encrypt Data (C0027)|--|
-|[encrypt data using DPAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml)|Encrypt Data (C0027)|CryptProtectMemory, CryptUnprotectMemory, crypt32.CryptProtectData, crypt32.CryptUnprotectData, System.Security.Cryptography.ProtectedData::Unprotect, System.Security.Cryptography.ProtectedData::Protect|
+|[encrypt data using DPAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml)|Encrypt Data (C0027)|CryptProtectMemory, CryptUnprotectMemory, crypt32.CryptProtectData, crypt32.CryptUnprotectData, System.Security.Cryptography.ProtectedData::Unprotect, System.Security.Cryptography.ProtectedData::Protect, SystemFunction040, SystemFunction041|
 |[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Encrypt Data::3DES (C0027.004)|--|
 |[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Encrypt Data::3DES (C0027.004)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
 |[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Encrypt Data::RC4 (C0027.009)|--|
@@ -96,12 +96,18 @@ Malware may encrypt data.
 |[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Encrypt Data::Skipjack (C0027.013)|--|
 |[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Encrypt Data::Blowfish (C0027.002)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Encrypt Data (C0027)|CryptEncrypt|
-|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Encrypt Data (C0027)|CryptEncrypt|
-|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Encrypt Data (C0027)|CryptEncrypt, GetUserNameW, GetComputerNameW|
-|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Encrypt Data (C0027)|CryptEncrypt, GetUserNameW, GetComputerNameW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[mass_data_encryption](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_crypto.py)|MassDataEncryption|Encrypt Data (C0027)|CryptEncrypt|
+|[encrypt_data_agenttesla](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/malware_data_encryption.py)|EnryptDataAgentTeslaHTTP|Encrypt Data (C0027)|CryptEncrypt|
+|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/malware_data_encryption.py)|EnryptDataAgentTeslaHTTPT2|Encrypt Data (C0027)|CryptEncrypt, GetComputerNameW, GetUserNameW|
+|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/malware_data_encryption.py)|EnryptDataNanoCore|Encrypt Data (C0027)|CryptEncrypt, GetComputerNameW, GetUserNameW|
+|[dcrat_behavior](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_dcrat.py)|DCRatAPIs|Encrypt Data (C0027)|CryptHashData|
+|[rat_nanocore](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_nanocore.py)|NanocoreRAT|Encrypt Data (C0027)|CryptHashData|
+|[rat_luminosity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_luminosity.py)|LuminosityRAT|Encrypt Data (C0027)|CryptHashData|
+|[script_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/script_downloader.py)|ScriptNetworkActvity|Encrypt Data (C0027)|SslEncryptPacket|
+|[ransomware_file_modifications](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_filemodifications.py)|RansomwareFileModifications|Encrypt Data (C0027)|--|
+|[blackrat_apis](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_blackremote.py)|BlackRATAPIs|Encrypt Data (C0027)|CryptHashData|
 
 ## Code Snippets
 

micro-behaviors/cryptography/encryption-key.md

@@ -55,10 +55,10 @@ Malware may import, generate, or otherwise use an encryption key.
 |[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encryption Key::RC4 KSA (C0028.002)|--|
 |[reference public RSA key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rsa/reference-public-rsa-key.yml)|Encryption Key (C0028)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Encryption Key (C0028)|CryptEncrypt|
-|[generates_crypto_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/generates_crypto_key.py)|Encryption Key (C0028)|CryptGenKey, CryptExportKey|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[mass_data_encryption](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_crypto.py)|MassDataEncryption|Encryption Key (C0028)|CryptEncrypt|
+|[generates_crypto_key](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/crypto_apis.py)|CryptGenKey|Encryption Key (C0028)|CryptGenKey, CryptExportKey|
 
 ## References
 

micro-behaviors/cryptography/generate-pseudorandom-sequence.md

@@ -44,7 +44,7 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0021.003|BlackEnergy generates random numbers via WinAPI. [[1]](#1)|
-|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI [[1]](#1)|
 
 ## Detection
 

micro-behaviors/data/compress-data.md

@@ -34,6 +34,7 @@ Malware may compress data.
 
 |Name|ID|Description|
 |---|---|---|
+|**aPLib**|C0024.003|Malware compresses data using aPLib.|
 |**IEncodingFilterFactory**|C0024.002|Malware compresses data using IEncodingFilterFactory.|
 |**QuickLZ**|C0024.001|Malware compresses data using QuickLZ.|
 

micro-behaviors/data/compression-library.md

@@ -35,7 +35,7 @@ Malware may utilize a compression library.
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|DarkComet linked against ZLIB. [[1]](#1)|
-|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Linked against ZLIB [[1]](#1)|
 
 ## Detection
 

micro-behaviors/data/decode-data.md

@@ -36,3 +36,13 @@ Malware may decode data.
 |---|---|---|
 |**Base64**|C0053.001|Malware may decode data using base64.|
 |**XOR**|C0053.002|Malware may use XOR to decode data.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../xample-malware/snake.md)|2004|C0053.001|Snake decodes data stored in base64 during the unpacking process [[1]](#1)|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

micro-behaviors/data/decompress-data.md

@@ -54,9 +54,9 @@ Malware may decompress data.
 |[decompress data using QuickLZ](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-quicklz.yml)|Decompress Data::QuickLZ (C0025.001)|--|
 |[decompress data using UCL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-ucl.yml)|Decompress Data (C0025)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decompress Data (C0025)|RtlDecompressBuffer|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Compression|Decompress Data (C0025)|RtlDecompressBuffer|
 
 ## References
 

micro-behaviors/file-system/alter-file-extension.md

@@ -38,8 +38,8 @@ Malware alters a file extension. This could be done for many reasons, including
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_extensions.py)|Alter File Extension (C0015)|--|
-
-|[mimics_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mimics_extension.py)|Alter File Extension (C0015)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[mimics_extension](https://github.com/CAPESandbox/community/blob/master/modules/signatures/all/mimics_filename.py)|MimicsExtension|Alter File Extension (C0015)|--|
+|[ransomware_file_modifications](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_filemodifications.py)|RansomwareFileModifications|Alter File Extension (C0015)|MoveFileWithProgressW, MoveFileWithProgressTransactedW, NtCreateFile, NtWriteFile|
+|[ransomware_extensions](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_fileextensions.py)|RansomwareExtensions|Alter File Extension (C0015)|--|

micro-behaviors/file-system/copy-file.md

@@ -40,6 +40,7 @@ Malware copies a file.
 |[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi copies files. [[1]](#1)|
 |[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip copies files. [[1]](#1)|
 |[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)|
+|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake copies files. [[2]](#2)|
 
 ## Detection
 
@@ -47,11 +48,13 @@ Malware copies a file.
 |---|---|---|
 |[copy file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/copy/copy-file.yml)|Copy File (C0045)|kernel32.CopyFile, kernel32.CopyFileEx, CopyFile2, CopyFileTransacted, LZCopy, System.IO.FileInfo::CopyTo, System.IO.File::Copy, kernel32.SHFileOperation|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[injection_needextension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_needextension.py)|Copy File (C0045)|NtCreateUserProcess, CreateProcessInternalW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[injection_needextension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_needextension.py)|InjectionExtension|Copy File (C0045)|NtCreateUserProcess, CreateProcessInternalW|
 
 ## References
 
 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="2">[2]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

micro-behaviors/file-system/create-directory.md

@@ -48,9 +48,9 @@ Malware creates a directory.
 |---|---|---|
 |[create directory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/create/create-directory.yml)|Create Directory (C0046)|kernel32.CreateDirectory, kernel32.CreateDirectoryEx, kernel32.CreateDirectoryTransacted, NtCreateDirectoryObject, ZwCreateDirectoryObject, SHCreateDirectory, SHCreateDirectoryEx, _mkdir, _wmkdir, System.IO.Directory::CreateDirectory, System.IO.DirectoryInfo::Create, System.IO.DirectoryInfo::CreateSubdirectory|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create Directory (C0046)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[arkei_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_arkei.py)|ArkeiFiles|Create Directory (C0046)|--|
 
 ### C0046 Snippet
 <details>

micro-behaviors/file-system/create-file.md

@@ -37,33 +37,48 @@ Malware creates a file.
 |**Create Office Document**|C0016.001|An Office document is created.|
 |**Create Ransomware File**|C0016.002|Create a file used by ransomware.|
 
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake creates files. [[1]](#1)|
+
 ## Detection
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[create or open file](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-file.yml)|Create File (C0016)|CreateFile, CreateFileEx, IoCreateFile, IoCreateFileEx, ZwOpenFile, ZwCreateFile, NtOpenFile, NtCreateFile, LZCreateFile, LZOpenFile, fopen, fopen64, fdopen, freopen, open, openat|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Create File (C0016)|NtWriteFile|
-|[spreading_autoruninf](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spreading_autoruninf.py)|Create File (C0016)|--|
-|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create File (C0016)|--|
-|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_files.py)|Create File (C0016)|--|
-|[nemty_note](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_note.py)|Create File (C0016)|NtWriteFile|
-|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_files.py)|Create File (C0016)|--|
-|[masslogger_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_files.py)|Create File (C0016)|--|
-|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_message.py)|Create File (C0016)|NtWriteFile|
-|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_file_created.py)|Create File (C0016)|NtCreateFile|
-|[neshta_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_files.py)|Create File (C0016)|NtCreateFile|
-|[copies_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/copies_self.py)|Create File (C0016)|--|
-|[office_write_exe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_write_exe.py)|Create File (C0016)|NtWriteFile|
-|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_file.py)|Create File (C0016)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
-|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_files.py)|Create File (C0016)|--|
-|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Create File (C0016)|--|
-|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Create File::Create Ransomware File (C0016.002)|--|
-|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_files.py)|Create File (C0016)|--|
-|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_files.py)|Create File (C0016)|--|
-|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_embedded_office_file.py)|Create File (C0016)|--|
-|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_embedded_office_file.py)|Create File::Create Office Document (C0016.001)|--|
-|[qulab_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/qulab_files.py)|Create File (C0016)|--|
-|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_files.py)|Create File (C0016)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[copies_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/copies_self.py)|CopiesSelf|Create File (C0016)|--|
+|[rat_pcclient](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_pcclient.py)|PcClientMutexes|Create File (C0016)|--|
+|[ransomware_radamant](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_radamant.py)|RansomwareRadamant|Create File (C0016)|--|
+|[remcos_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/remcos.py)|RemcosFiles|Create File (C0016)|--|
+|[karagany_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_karagany.py)|KaraganyFiles|Create File (C0016)|--|
+|[obliquerat_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_oblique.py)|ObliquekRATFiles|Create File (C0016)|--|
+|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_message.py)|RansomwareMessage|Create File (C0016)|NtWriteFile|
+|[rat_luminosity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_luminosity.py)|LuminosityRAT|Create File (C0016)|NtCreateFile, CryptHashData|
+|[xpertrat_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_xpert.py)|XpertRATFiles|Create File (C0016)|--|
+|[nemty_note](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNote|Create File (C0016)|NtWriteFile|
+|[office_write_exe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_write_exe.py)|OfficeWriteEXE|Create File (C0016)|NtWriteFile|
+|[warzonerat_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_warzone.py)|WarzoneRATFiles|Create File (C0016)|--|
+|[spreading_autoruninf](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/spreading_autoruninf.py)|CreatesAutorunInf|Create File (C0016)|--|
+|[neshta_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|NeshtaFiles|Create File (C0016)|NtCreateFile|
+|[arkei_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_arkei.py)|ArkeiFiles|Create File (C0016)|--|
+|[office_postscript](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/office_exploit.py)|OfficePostScript|Create File (C0016)|NtWriteFile|
+|[rat_nanocore](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_nanocore.py)|NanocoreRAT|Create File (C0016)|CryptHashData|
+|[qulab_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_qulab.py)|QulabFiles|Create File (C0016)|--|
+|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_files.py)|RansomwareFiles|Create File (C0016), Create File (C0016)|--|
+|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_files.py)|RansomwareFiles|Create File (C0016), Create File::Create Ransomware File (C0016.002)|--|
+|[dcrat_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_dcrat.py)|DCRatFiles|Create File (C0016)|--|
+|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/office_rtf.py)|RTFEmbeddedOfficeFile|Create File (C0016)|--|
+|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/office_rtf.py)|RTFEmbeddedOfficeFile|Create File::Create Office Document (C0016.001)|--|
+|[stack_pivot_file_created](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/stack_pivot.py)|StackPivotFileCreated|Create File (C0016)|NtCreateFile|
+|[masslogger_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerFiles|Create File (C0016)|--|
+|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_file.py)|StealthFile|Create File (C0016)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

micro-behaviors/file-system/delete-directory.md

@@ -35,8 +35,8 @@ Malware deletes a directory.
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut deletes directories. [[1]](#1)|
-|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Delete directory [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Delete directory [[1]](#1)|
 
 ## Detection
 

micro-behaviors/file-system/delete-file.md

@@ -47,6 +47,7 @@ Malware deletes a file.
 |[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon deletes files. [[1]](#1)|
 |[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)|
 |[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)|
+|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake deletes files. [[2]](#2)|
 
 ## Detection
 
@@ -54,14 +55,17 @@ Malware deletes a file.
 |---|---|---|
 |[delete file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/delete/delete-file.yml)|Delete File (C0047)|kernel32.DeleteFile, DeleteFileTransacted, NtDeleteFile, ZwDeleteFile, remove, _wremove, System.IO.File::Delete, System.IO.FileSystemInfo::Delete, kernel32.SHFileOperation, MoveFileEx|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clears_logs.py)|Delete File (C0047)|--|
-|[removes_zoneid_ads](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_zoneid_ads.py)|Delete File (C0047)|DeleteFileW, DeleteFileA|
-|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_recyclebin.py)|Delete File (C0047)|--|
-|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_task_delete.py)|Delete File (C0047)|DeleteFileW|
-|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA|
-|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/clears_logs.py)|ClearsLogs|Delete File (C0047)|--|
+|[trickbot_task_delete](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/trickbot_files.py)|TrickBotTaskDelete|Delete File (C0047)|DeleteFileW|
+|[upatre_behavior](https://github.com/CAPESandbox/community/blob/master/modules/signatures/deprecated/upatre_apis.py)|Upatre_APIs|Delete File (C0047)|DeleteFileA|
+|[ransomware_file_modifications](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_filemodifications.py)|RansomwareFileModifications|Delete File (C0047)|MoveFileWithProgressW, MoveFileWithProgressTransactedW, NtCreateFile, NtWriteFile|
+|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/anomalous_deletefile.py)|anomalous_deletefile|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA|
+|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_self.py)|DeletesSelf|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
+|[deletes_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/linux/deletes_files.py)|LinuxDeletesFile|Delete File (C0047)|--|
+|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_recyclebin.py)|RansomwareRecyclebin|Delete File (C0047)|--|
+|[removes_zoneid_ads](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_zoneid_ads.py)|RemovesZoneIdADS|Delete File (C0047)|DeleteFileW, DeleteFileA|
 
 ### C0047 Snippet
 <details>
@@ -81,3 +85,6 @@ sbb     eax, eax        ; isolate the carry flag from the previous comparison.
 
 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="2">[2]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+
+

micro-behaviors/file-system/move-file.md

@@ -47,9 +47,9 @@ Malware moves a file.
 |---|---|---|
 |[move file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/move/move-file.yml)|Move File (C0063)|kernel32.MoveFile, kernel32.MoveFileEx, MoveFileWithProgress, MoveFileTransacted, rename, _wrename, System.IO.FileInfo::MoveTo, System.IO.File::Move, kernel32.SHFileOperation|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[move_file_on_reboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/move_file_on_reboot.py)|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[move_file_on_reboot](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/move_file_on_reboot.py)|move_file_on_reboot|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW|
 
 ### C0063 Snippet
 <details>

micro-behaviors/file-system/read-file.md

@@ -58,14 +58,14 @@ Malware reads a file.
 |[read file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-file-on-linux.yml)|Read File (C0051)|fgetc, fgets, getc, getchar, read, getline, getdelim, fgetwc, getwc, fscanf, vfscanf, fread|
 |[read .ini file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-ini-file.yml)|Read File (C0051)|GetPrivateProfileInt, GetPrivateProfileString, GetPrivateProfileStruct, GetPrivateProfileSection, GetPrivateProfileSectionNames, GetFullPathName|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[reads_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/reads_self.py)|Read File (C0051)|NtReadFile, NtSetInformationFile, NtClose, NtCreateFile, NtOpenFile|
-|[accesses_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_sysvol.py)|Read File (C0051)|--|
-|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_devices.py)|Read File (C0051)|--|
-|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectfile.py)|Read File (C0051)|--|
-|[infostealer_browser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_browser.py)|Read File (C0051)|NtReadFile, CopyFileA, CopyFileExW, CopyFileW|
-|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Read File (C0051)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[reads_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/reads_self.py)|ReadsSelf|Read File (C0051)|NtReadFile, NtSetInformationFile, NtClose, NtCreateFile, NtOpenFile|
+|[accesses_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_sysvol.py)|AccessesSysvol|Read File (C0051)|--|
+|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_devices.py)|AntiDBGDevices|Read File (C0051)|--|
+|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectfile.py)|AntiAVDetectFile|Read File (C0051)|--|
+|[infostealer_browser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_browser.py)|BrowserStealer|Read File (C0051)|NtReadFile, CopyFileA, CopyFileExW, CopyFileW|
+|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectfile.py)|AntiAnalysisDetectFile|Read File (C0051)|--|
 
 ### C0051 Snippet
 <details>
@@ -84,5 +84,4 @@ call    qword ptr [->KERNEL32.DLL::ReadFile] ; API call to read file specified i
 
 ## References
 
-<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
-
+<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022

micro-behaviors/file-system/set-file-attributes.md

@@ -45,7 +45,7 @@ Malware sets file attributes.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[change file permission on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/change-file-permission-on-linux.yml)|Set File Attributes (C0050)|chown, fchown, lchown, fchownat|
+|[change file permission on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/change-file-permission-on-linux.yml)|Set File Attributes (C0050)|chown, fchown, lchown, fchownat, chmod, fchmod, fchmodat|
 |[set file attributes](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/set-file-attributes.yml)|Set File Attributes (C0050)|kernel32.SetFileAttributes, ZwSetInformationFile, NtSetInformationFile, System.IO.File::SetAttributes, System.IO.File::SetCreationTime, System.IO.File::SetCreationTimeUtc, System.IO.File::SetLastAccessTime, System.IO.File::SetLastAccessTimeUtc, System.IO.File::SetLastWriteTime, System.IO.File::SetLastWriteTimeUtc|
 
 ### C0050 Snippet

micro-behaviors/file-system/writes-file.md

@@ -51,21 +51,22 @@ Malware writes to a file.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[write file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-linux.yml)|Writes File (C0052)|fputc, fputs, putc, write, fputwc, putwc, fputws, write, fwrite, putwchar|
+|[write file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-linux.yml)|Writes File (C0052)|fputc, fputs, putc, write, fputwc, putwc, fputws, fwrite, putwchar, dprintf, vdprnitf, fprintf, vfprintf|
 |[write file on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-windows.yml)|Writes File (C0052)|kernel32.WriteFile, kernel32.WriteFileEx, NtWriteFile, ZwWriteFile, _fwrite, fwrite, System.IO.File::WriteAllBytes, System.IO.File::WriteAllBytesAsync, System.IO.File::WriteAllLines, System.IO.File::WriteAllLinesAsync, System.IO.File::WriteAllText, System.IO.File::WriteAllTextAsync, System.IO.File::AppendAllLines, System.IO.File::AppendAllLinesAsync, System.IO.File::AppendAllText, System.IO.File::AppendAllTextAsync, System.IO.File::AppendText, System.IO.FileInfo::AppendText|
 |[create process memory minidump](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/dump/create-process-memory-minidump.yml)|Writes File (C0052)|dbghelp.MiniDumpWriteDump|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/poullight_files.py)|Writes File (C0052)|--|
-|[masslogger_artifacts](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_artifacts.py)|Writes File (C0052)|CryptDecrypt, FindFirstFileExW|
-|[masslogger_version](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_version.py)|Writes File (C0052)|NtWriteFile|
-|[writes_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/writes_sysvol.py)|Writes File (C0052)|--|
-|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wiper_zeroedbytes.py)|Writes File (C0052)|NtWriteFile|
-|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_hostfile.py)|Writes File (C0052)|--|
-|[apocalypse_stealer_file_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/apocalypse_stealer_file_behavior.py)|Writes File (C0052)|--|
-|[echelon_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/echelon_files.py)|Writes File (C0052)|--|
-|[upatre_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/upatre_files.py)|Writes File (C0052)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[upatre_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/upatre_files.py)|UpatreFiles|Writes File (C0052)|--|
+|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/wiper.py)|WiperZeroedBytes|Writes File (C0052)|NtWriteFile|
+|[modify_hostsfile](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/modifies_hostsfile.py)|Modifies_HostFile|Writes File (C0052)|--|
+|[writes_sysvol](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/accesses_sysvol.py)|WritesSysvol|Writes File (C0052)|--|
+|[ursnif_behavior](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/trojan_ursnif.py)|UrsnifBehavior|Writes File (C0052)|--|
+|[poullight_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_poullight.py)|PoullightFiles|Writes File (C0052)|--|
+|[echelon_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_echelon.py)|EchelonFiles|Writes File (C0052)|--|
+|[apocalypse_stealer_file_behavior](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_apocalypse.py)|ApocalypseStealerFileBehavior|Writes File (C0052)|--|
+|[masslogger_version](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerVersion|Writes File (C0052)|NtWriteFile|
+|[masslogger_artifacts](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerArtifacts|Writes File (C0052)|FindFirstFileExW, CryptDecrypt|
 
 ### C0052 Snippet
 <details>

micro-behaviors/hardware/install-driver.md

@@ -40,5 +40,5 @@ Malware installs a driver or minifilter.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[install driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/install-driver.yml)|Install Driver (C0037)|ntdll.NtLoadDriver, ZwLoadDriver|
+|[install driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/install-driver.yml)|Install Driver (C0037)|ntdll.NtLoadDriver, ZwLoadDriver, NtSetSystemInformation ZwSetSystemInformation|
 |[register minifilter driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/filter/register-minifilter-driver.yml)|Install Driver::Minifilter (C0037.001)|FltRegisterFilter|

micro-behaviors/hardware/load-driver.md

@@ -42,6 +42,6 @@ Malware loads a device driver or minifilter.
 |---|---|---|
 |[start minifilter driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/filter/start-minifilter-driver.yml)|Load Driver::Minifilter (C0023.001)|FltStartFiltering|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_load.py)|Load Driver (C0023)|NtLoadDriver|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/driver_load.py)|DriverLoad|Load Driver (C0023)|NtLoadDriver|

micro-behaviors/memory/allocate-memory.md

@@ -48,14 +48,14 @@ Malware allocates memory, often to unpack itself.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)|--|
+|[allocate or change RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-or-change-rwx-memory.yml)|Allocate Memory (C0007)|--|
 |[allocate memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-memory.yml)|Allocate Memory (C0007)|kernel32.VirtualAlloc, kernel32.VirtualAllocEx, kernel32.VirtualAllocExNuma, kernel32.VirtualProtect, kernel32.VirtualProtectEx, NtAllocateVirtualMemory, ZwAllocateVirtualMemory, NtMapViewOfSection, ZwMapViewOfSection, NtProtectVirtualMemory, ZwProtectVirtualMemory|
-|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)|--|
+|[allocate or change RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-or-change-rw-memory.yml)|Allocate Memory (C0007)|--|
 |[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[Unpacker](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Unpacker|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
 
 ### C0007 Snippet
 <details>

micro-behaviors/memory/change-memory-protection.md

@@ -46,9 +46,9 @@ Malware may change memory protection. For example, read-write memory may be chan
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Change Memory Protection (C0008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|antidebug_guardpages|Change Memory Protection (C0008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
 
 ### C0008 Snippet
 <details>

micro-behaviors/memory/heap-spray.md

@@ -32,7 +32,7 @@ Malware may use heap spraying to write a sequence of bytes on the heap section o
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_heapspray.py)|Heap Spray (C0006)|NtAllocateVirtualMemory|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_heapspray.py)|ExploitHeapspray|Heap Spray (C0006)|NtAllocateVirtualMemory|
 

micro-behaviors/operating-system/console.md

@@ -37,9 +37,9 @@ Malware modifies the console.
 |[set console window title](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/console/set-console-window-title.yml)|Console (C0033)|kernel32.SetConsoleTitle|
 |[manipulate console buffer](https://github.com/mandiant/capa-rules/blob/master/host-interaction/console/manipulate-console-buffer.yml)|Console (C0033)|kernel32.SetConsoleCursorPosition, kernel32.ReadConsoleOutputCharacter, kernel32.WriteConsoleOutputCharacter, kernel32.WriteConsoleOutput, kernel32.WriteConsoleInput, kernel32.GetStdHandle, System.Console::Write, System.Console::WriteLine|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Console (C0033)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bcdedit_command.py)|BCDEditCommand|Console (C0033)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
 
 ### C0033 Snippet
 <details>

micro-behaviors/operating-system/registry.md

@@ -97,128 +97,129 @@ Malware modifies the registry.
 |[create or open registry key](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-registry-key.yml)|Registry::Create Registry Key (C0036.004)|advapi32.RegOpenKey, advapi32.RegOpenKeyEx, advapi32.RegCreateKey, advapi32.RegCreateKeyEx, advapi32.RegOpenCurrentUser, advapi32.RegOpenKeyTransacted, advapi32.RegOpenUserClassesRoot, advapi32.RegCreateKeyTransacted, ZwOpenKey, ZwOpenKeyEx, ZwCreateKey, ZwOpenKeyTransacted, ZwOpenKeyTransactedEx, ZwCreateKeyTransacted, NtOpenKey, NtCreateKey, SHRegOpenUSKey, SHRegCreateUSKey, RtlCreateRegistryKey, Microsoft.Win32.RegistryKey::OpenSubKey, Microsoft.Win32.RegistryKey::OpenBaseKey, Microsoft.Win32.RegistryKey::OpenRemoteBaseKey, Microsoft.Win32.RegistryKey::CreateSubKey|
 |[create or open registry key](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-registry-key.yml)|Registry::Open Registry Key (C0036.003)|advapi32.RegOpenKey, advapi32.RegOpenKeyEx, advapi32.RegCreateKey, advapi32.RegCreateKeyEx, advapi32.RegOpenCurrentUser, advapi32.RegOpenKeyTransacted, advapi32.RegOpenUserClassesRoot, advapi32.RegCreateKeyTransacted, ZwOpenKey, ZwOpenKeyEx, ZwCreateKey, ZwOpenKeyTransacted, ZwOpenKeyTransactedEx, ZwCreateKeyTransacted, NtOpenKey, NtCreateKey, SHRegOpenUSKey, SHRegCreateUSKey, RtlCreateRegistryKey, Microsoft.Win32.RegistryKey::OpenSubKey, Microsoft.Win32.RegistryKey::OpenBaseKey, Microsoft.Win32.RegistryKey::OpenRemoteBaseKey, Microsoft.Win32.RegistryKey::CreateSubKey|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Registry (C0036)|--|
-|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Registry (C0036)|--|
-|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Registry::Set Registry Value (C0036.001)|--|
-|[modirat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modirat_behavior.py)|Registry (C0036)|--|
-|[darkcomet_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/darkcomet_regkeys.py)|Registry (C0036)|--|
-|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_revil_regkey.py)|Registry (C0036)|--|
-|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Registry (C0036)|--|
-|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Registry::Set Registry Value (C0036.001)|--|
-|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Registry (C0036)|--|
-|[mapped_drives_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mapped_drives_uac.py)|Registry (C0036)|--|
-|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_networking_icon.py)|Registry (C0036)|--|
-|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Registry (C0036)|--|
-|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_power_options.py)|Registry (C0036)|--|
-|[disables_cpl_disable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_cpl_disable.py)|Registry (C0036)|--|
-|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Registry (C0036)|--|
-|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Registry::Set Registry Value (C0036.001)|--|
-|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/hides_recycle_bin_icon.py)|Registry (C0036)|--|
-|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_restore_default_state.py)|Registry (C0036)|--|
-|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_auto_app_termination.py)|Registry (C0036)|--|
-|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_regkeys.py)|Registry (C0036)|--|
-|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Registry (C0036)|--|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Registry (C0036)|--|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Registry::Query Registry Key (C0036.005)|--|
-|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/prevents_safeboot.py)|Registry (C0036)|--|
-|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|Registry (C0036)|--|
-|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|Registry::Open Registry Key (C0036.003)|--|
-|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|Registry (C0036)|--|
-|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|Registry::Open Registry Key (C0036.003)|--|
-|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Registry (C0036)|--|
-|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_context_menus.py)|Registry (C0036)|--|
-|[ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ketrican_regkeys.py)|Registry (C0036)|--|
-|[ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ketrican_regkeys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Registry (C0036)|--|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Registry::Query Registry Key (C0036.005)|--|
-|[evil_grab](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Registry (C0036)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
-|[PlugX](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Registry (C0036)|memcpy, RtlDecompressBuffer|
-|[reg_binary](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Registry (C0036)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
-|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Registry (C0036)|--|
-|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_run_command.py)|Registry (C0036)|--|
-|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Registry (C0036)|--|
-|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Registry (C0036)|--|
-|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Registry (C0036)|--|
-|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[packer_armadillo_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_armadillo_regkey.py)|Registry (C0036)|--|
-|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_backups.py)|Registry (C0036)|--|
-|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Registry (C0036)|--|
-|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Registry::Open Registry Key (C0036.003)|--|
-|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_largekey.py)|Registry (C0036)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
-|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_username_startmenu.py)|Registry (C0036)|--|
-|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Registry (C0036)|--|
-|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_startmenu_search.py)|Registry (C0036)|--|
-|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Registry (C0036)|--|
-|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Registry (C0036)|--|
-|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Registry (C0036)|--|
-|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_regkeys.py)|Registry (C0036)|RegSetValueExA, RegSetValueExW|
-|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Registry (C0036)|NtCreateKey, NtSetValueKey|
-|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Registry (C0036)|--|
-|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Registry::Set Registry Value (C0036.001)|--|
-|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Registry (C0036)|--|
-|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Registry::Set Registry Value (C0036.001)|--|
-|[modify_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_certs.py)|Registry (C0036)|--|
-|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Registry (C0036)|--|
-|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Registry::Set Registry Value (C0036.001)|--|
-|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Registry (C0036)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
-|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
-|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_appv_virtualization.py)|Registry (C0036)|--|
-|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Registry (C0036)|--|
-|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Registry (C0036)|--|
-|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Registry (C0036)|--|
-|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Registry (C0036)|RegQueryValueExW, RegSetValueExW|
-|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Registry (C0036)|--|
-|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Registry::Query Registry Key (C0036.005)|--|
-|[dotnet_clr_usagelog_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dotnet_clr_usagelog_regkeys.py)|Registry (C0036)|--|
-|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rdptcp_key.py)|Registry (C0036)|--|
-|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Registry (C0036)|--|
-|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[disables_system_restore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_system_restore.py)|Registry (C0036)|--|
-|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_folder_options.py)|Registry (C0036)|--|
-|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Registry (C0036)|--|
-|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[removes_security_maintenance_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_security_maintenance_icon.py)|Registry (C0036)|--|
-|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Registry (C0036)|--|
-|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Registry (C0036)|--|
-|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Registry (C0036)|--|
-|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Registry::Query Registry Key (C0036.005)|--|
-|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Registry (C0036)|--|
-|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Registry::Set Registry Value (C0036.001)|--|
-|[enables_wdigest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enables_wdigest.py)|Registry (C0036)|--|
-|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_startmenu_defaults.py)|Registry (C0036)|--|
-|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_uac.py)|Registry (C0036)|--|
-|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Registry (C0036)|--|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Registry (C0036)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Registry::Query Registry Value (C0036.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_perfkey.py)|Registry (C0036)|--|
-|[modify_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_oem_information.py)|Registry (C0036)|--|
-|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Registry (C0036)|--|
-|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Registry (C0036)|--|
-|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Registry (C0036)|--|
-|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Registry (C0036)|--|
-|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Registry (C0036)|--|
-|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Registry (C0036)|--|
-|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Registry::Query Registry Key (C0036.005)|--|
-|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectreg.py)|Registry (C0036)|--|
-|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectreg.py)|Registry::Query Registry Key (C0036.005)|--|
-|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Registry (C0036)|--|
-|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windowsupdate.py)|Registry (C0036)|--|
-|[recon_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_programs.py)|Registry (C0036)|RegQueryValueExA, RegQueryValueExW|
-|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Registry (C0036)|--|
-|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Registry::Set Registry Value (C0036.001)|--|
-|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_fingerprint.py)|Registry (C0036)|--|
-|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_pinned_programs.py)|Registry (C0036)|--|
-|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_regkeys.py)|Registry (C0036)|--|
-|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Registry (C0036)|--|
-|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Registry::Set Registry Value (C0036.001)|--|
-|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Registry (C0036)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesMailslot|Registry (C0036)|--|
+|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesMailslot|Registry::Open Registry Key (C0036.003)|--|
+|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesNetlogonRegkey|Registry (C0036)|--|
+|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesNetlogonRegkey|Registry::Open Registry Key (C0036.003)|--|
+|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|AntiAnalysisDetectReg|Registry (C0036)|--|
+|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|AntiAnalysisDetectReg|Registry::Open Registry Key (C0036.003)|--|
+|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry (C0036)|--|
+|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry::Query Registry Key (C0036.005)|--|
+|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|AntiAVSRP|Registry (C0036)|--|
+|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|AntiAVSRP|Registry::Set Registry Value (C0036.001)|--|
+|[antiemu_wine](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|WineDetectReg|Registry (C0036)|--|
+|[antiemu_wine](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|WineDetectReg|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|BochsDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry (C0036)|--|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|AntiVMCPU|Registry (C0036)| RegQueryValueExW, RegQueryValueExA, NtQueryValueKey|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|AntiVMCPU|Registry::Query Registry Key (C0036.005)| RegQueryValueExW, RegQueryValueExA, NtQueryValueKey|
+|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|AntiVMDiskReg|Registry (C0036)|--|
+|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|AntiVMDiskReg|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|AntiVMSCSI|Registry (C0036)| RegOpenKeyExA, RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW|
+|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|AntiVMSCSI|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry (C0036)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry::Query Registry Value (C0036.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry (C0036)|--|
+|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|HyperVDetectKeys|Registry (C0036)|--|
+|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|HyperVDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|ParallelsDetectKeys|Registry (C0036)|--|
+|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|ParallelsDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|VBoxDetectKeys|Registry (C0036)|--|
+|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|VBoxDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|VMwareDetectKeys|Registry (C0036)|--|
+|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|VMwareDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|AntiVMDiskReg|Registry (C0036)|--|
+|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|VPCDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry (C0036)|--|
+|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[banker_geodo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Geodo|Registry (C0036)|--|
+|[banker_geodo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Geodo|Registry::Set Registry Value (C0036.001)|--|
+|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|BlackRATRegistryKeys|Registry (C0036)| RegSetValueExW, RegQueryValueExW|
+|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|BrowserAddon|Registry (C0036)|--|
+|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|BrowserAddon|Registry::Set Registry Value (C0036.001)|--|
+|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_bho.py)|BrowserHelperObject|Registry (C0036)|--|
+|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_bho.py)|BrowserHelperObject|Registry::Set Registry Value (C0036.001)|--|
+|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|BrowserSecurity|Registry (C0036)|--|
+|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|BrowserSecurity|Registry::Set Registry Value (C0036.001)|--|
+|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|browser_startpage|Registry (C0036)|--|
+|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|browser_startpage|Registry::Set Registry Value (C0036.001)|--|
+|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|BypassFirewall|Registry (C0036)|--|
+|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|BypassFirewall|Registry::Set Registry Value (C0036.001)|--|
+|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_largekey.py)|CreatesLargeKey|Registry (C0036)| NtSetValueKey, RegSetValueExA RegSetValueExW|
+|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|CreatesNullValue|Registry (C0036)| NtSetValueKey, NtCreateKey|
+|[darkcomet_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/darkcomet_regkeys.py)|DarkCometRegkeys|Registry (C0036)|--|
+|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|DisablesAppLaunch|Registry (C0036)|--|
+|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_appv_virtualization.py)|DisablesAppVirtualiztion|Registry (C0036)|--|
+|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app_autotermination.py)|DisablesAutomaticAppTermination|Registry (C0036)|--|
+|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_backups.py)|DisablesBackups|Registry (C0036)|--|
+|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_browserwarn.py)|DisablesBrowserWarn|Registry (C0036)|--|
+|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_context_menus.py)|DisablesContextMenus|Registry (C0036)|--|
+|[disables_cpl_display](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_cpl_display.py)|DisablesCPLDisplay|Registry (C0036)|--|
+|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_event_logging.py)|DisablesEventLogging|Registry (C0036)|--|
+|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_folder_options.py)|DisableFolderOptions|Registry (C0036)|--|
+|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_notificationcenter.py)|DisablesNotificationCenter|Registry (C0036)|--|
+|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_power_options.py)|DisablesPowerOptions|Registry (C0036)|--|
+|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_restore_default_state.py)|DisablesRestoreDefaultState|Registry (C0036)|--|
+|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_run_command.py)|DisableRunCommand|Registry (C0036)|--|
+|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_smartscreen.py)|DisablesSmartScreen|Registry (C0036)|--|
+|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|DisablesStartMenuSearch|Registry (C0036)|--|
+|[disables_sysrestore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_sysrestore.py)|DisablesSystemRestore|Registry (C0036)|--|
+|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_uac.py)|DisablesUAC|Registry (C0036)|--|
+|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wer.py)|DisablesWER|Registry (C0036)|--|
+|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|DisablesWindowsDefenderDISM|Registry (C0036)|--|
+|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|DisablesWindowsDefenderLogging|Registry (C0036)|--|
+|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windowsupdate.py)|DisablesWindowsUpdate|Registry (C0036)|--|
+|[dotnet_clr_usagelog_regkeys](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/modifies_dotnetclr_knobs.py)|DotNetCLRUsageLogKnow|Registry (C0036)|--|
+|[enables_wdigest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/credential_access.py)|EnablesWDigest|Registry (C0036)|--|
+|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/hides_recyclebin_icon.py)|HidesRecycleBinIcon|Registry (C0036)|--|
+|[ketrican_reg_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/backdoor_ketrican_regkeys.py)|KetricanRegkeys| Registry::Query Registry Key (C0036.005)|--|
+|[ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/backdoor_ketrican_regkeys.py)|KetricanRegkeys| Registry (C0036)|--|
+|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|LimeRATRegkeys|Registry (C0036)|--|
+|[mapped_drives_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/forces_mappeddrives_uac.py)|MappedDrivesUAC| Registry (C0036)|--|
+|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_medusalocker.py)|MedusaLockerRegkeys|Registry (C0036)|--|
+|[modifies_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_certs.py)|ModifiesCerts| Registry (C0036)|--|
+|[modifies_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_oem.py)|ModifiesOEMInformation|Registry (C0036)|--|
+|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|ModifiesAttachmentManager|Registry (C0036)|--|
+|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|ModifiesAttachmentManager|Registry::Set Registry Value (C0036.001)|--|
+|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_proxy.py)|ModifyProxy|Registry (C0036)|--|
+|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_proxy.py)|ModifyProxy|Registry::Set Registry Value (C0036.001)|--|
+|[modirat_behavior](https://https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_modi.py)|ModiRATBehavior|Registry (C0036)|--|
+|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_nemty.py)|NemtyRegkeys|Registry (C0036)|--|
+|[neshta_regkeys](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|NeshtaRegKeys|Registry (C0036)| RegSetValueExA, RegSetValueExW|
+|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_njrat_regkeys.py)|NjratRegkeys|Registry (C0036)|--|
+|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|OfficePerfKey|Registry (C0036)|--|
+|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_security.py)|OfficeSecurity|Registry (C0036)|--|
+|[packer_armadillo_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/packer_armadillo_regkey.py)|ArmadilloRegKey| Registry (C0036)|--|
+|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|PersistenceIFEO|Registry (C0036)|--|
+|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_remotedesktop.py)|PersistenceRDPRegistry|Registry (C0036)|--|
+|[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_shim.py)|PersistenceShimDatabase|Registry (C0036)|--|
+|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|PersistenceSilentProcessExit|Registry (C0036)|--|
+|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/prevents_safeboot.py)|PreventsSafeboot|Registry (C0036)|--|
+|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_radamant.py)|RansomwareRadamant|Registry (C0036)|--|
+|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_revil_regkey.py)|RevilRegkey|Registry (C0036)|--|
+|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_spynet.py)|SpynetRat|Registry (C0036)|--|
+|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|RDPTCPKey|Registry (C0036)|--|
+|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_fingerprint.py)|Fingerprint|Registry (C0036)|--|
+|[recon_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_programs.py)|InstalledApps|Registry (C0036)|RegQueryValueExA, RegQueryValueExW|
+|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|RemcosRegkeys|Registry (C0036)|--|
+|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_networking_icon.py)|RemovesNetworkingIcon|Registry (C0036)|--|
+|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_pinned_programs.py)|RemovesPinnedPrograms|Registry (C0036)|--|
+|[removes_sec_maintain_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_sec_maintain_icon.py)|RemovesSecurityAndMaintenanceIcon|Registry (C0036)|--|
+|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_startmenu_defaults.py)|RemovesStartMenuDefaults|Registry (C0036)|--|
+|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_username_startmenu.py)|RemovesUsernameStartMenu|Registry (C0036)|--|
+|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|RemovesWindowsDefenderContextMenu|Registry (C0036)|--|
+|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|StealthHiddenExtension|Registry (C0036)|--|
+|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|StealthHiddenReg|Registry (C0036)|--|
+|[stealth_hidenotifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|StealthHideNotifications|Registry (C0036)|--|
+|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_etw.py)|TampersETW|Registry (C0036)|--|
+|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_powershell_logging.py)|TampersPowerShellLogging|Registry (C0036)|--|
+|[ursnif_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trojan_ursnif.py)|UrsnifBehavior|Registry (C0036)|--|
+|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_warzone.py)|WarzoneRATRegkeys|Registry (C0036)|--|![image](https://github.com/user-attachments/assets/1fd99cef-9381-4ab6-a06b-e822e934cfcb)
 
 ### C0036.005 Snippet
 <details>

micro-behaviors/operating-system/wallpaper.md

@@ -36,6 +36,6 @@ Malware modifies the wallpaper.
 |---|---|---|
 |[change the wallpaper](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/session/wallpaper/change-the-wallpaper.yml)|Wallpaper (C0035)|SystemParametersInfo|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[modify_desktop_wallpaper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_desktop_wallpaper.py)|Wallpaper (C0035)|SystemParametersInfoA, SystemParametersInfoW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[modify_desktop_wallpaper](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/modifies_wallpaper.py)|ModifiesDesktopWallpaper|Wallpaper (C0035)|SystemParametersInfoA, SystemParametersInfoW|

micro-behaviors/process/README.md

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>29 November 2022</b></td>
+<td><b>16 September 2024</b></td>
 </tr>
 </table>
 
@@ -29,8 +29,7 @@ Micro-behaviors related to processes.
 * **Set Thread Context** [C0072](../process/set-thread-context.md)
 * **Set Thread Local Storage Value** [C0041](../process/set-thread-local-storage-value.md)
 * **Suspend Thread** [C0055](../process/suspend-thread.md)	
-* **Synchronization** [C0022](../process/synchronization.md)
 * **Terminate Process** [C0018](../process/terminate-process.md)
 * **Terminate Thread** [C0039](../process/terminate-thread.md)
 * **Unmap Section View** [C0070](../process/unmap-section-view.md)
-* **Write Process Memory** [C0071](../process/write-process-memory.md)
+* **Write Process Memory** [C0071](../process/write-process-memory.md)

micro-behaviors/process/allocate-thread-local-storage.md

@@ -41,7 +41,7 @@ Malware allocates thread local storage.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc|
+|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/tls/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc|
 
 ### C0040 Snippet
 <details>

micro-behaviors/process/check-mutex.md

@@ -44,12 +44,13 @@ Malware checks a mutex.
 |[check mutex](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/check-mutex.yml)|Check Mutex (C0043)|kernel32.OpenMutex, System.Threading.Mutex::OpenExisting, System.Threading.Mutex::TryOpenExisting, kernel32.GetLastError|
 |[check mutex and exit](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/check-mutex-and-exit.yml)|Check Mutex (C0043)|ExitProcess, exit, _Exit, _exit, WaitForSingleObject, GetLastError|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_mutex.py)|Check Mutex (C0043)|--|
-|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_mutex.py)|Check Mutex (C0043)|--|
-|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_mutexes.py)|Check Mutex (C0043)|--|
-|[purplewave_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_mutexes.py)|Check Mutex (C0043)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_mutex.py)|VPCDetectMutex|Check Mutex (C0043)|--|
+|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_mutex.py)|AntisandboxSboxieMutex|Check Mutex (C0043)|--|
+|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_mutexes.py)|VMwareDetectMutexes|Check Mutex (C0043)|--|
+|[purplewave_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_purplewave.py)|PurpleWaveMutexes|Check Mutex (C0043)|--|
+|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_mutex.py)|AntisandboxSboxieMutex|Check Mutex (C0043)|--|
 
 ### C0043 Snippet
 <details>

micro-behaviors/process/create-mutex.md

@@ -21,14 +21,14 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>30 April 2024</b></td>
+<td><b>16 September 2024</b></td>
 </tr>
 </table>
 
 
 # Create Mutex
 
-Malware creates a mutex. 
+Malware creates a mutex. Mutexes may be created for synchronization purposes (two or more processes/threads to share a resource).
 
 ## Use in Malware
 
@@ -48,59 +48,68 @@ Malware creates a mutex.
 |[create mutex](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/create-mutex.yml)|Create Mutex (C0042)|kernel32.CreateMutex, kernel32.CreateMutexEx, System.Threading.Mutex::ctor|
 |[lock file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/lock-file.yml)|Create Mutex (C0042)|fcntl|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[banker_zeus_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_mutex.py)|Create Mutex (C0042)|--|
-|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/parallax_mutexes.py)|Create Mutex (C0042)|--|
-|[gandcrab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/gandcrab_mutexes.py)|Create Mutex (C0042)|--|
-|[packer_armadillo_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_armadillo_mutex.py)|Create Mutex (C0042)|--|
-|[fleercivet_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/fleercivet_mutex.py)|Create Mutex (C0042)|--|
-|[renamer_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/renamer_mutexes.py)|Create Mutex (C0042)|--|
-|[revil_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/revil_mutexes.py)|Create Mutex (C0042)|--|
-|[trickbot_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_mutex.py)|Create Mutex (C0042)|--|
-|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_fynloski_mutexes.py)|Create Mutex (C0042)|--|
-|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_beebus_mutexes.py)|Create Mutex (C0042)|--|
-|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_mutexes.py)|Create Mutex (C0042)|--|
-|[nemty_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_mutexes.py)|Create Mutex (C0042)|--|
-|[stop_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stop_ransom_mutexes.py)|Create Mutex (C0042)|--|
-|[okrum_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/okrum_mutexes.py)|Create Mutex (C0042)|--|
-|[pysa_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pysa_mutexes.py)|Create Mutex (C0042)|--|
-|[banker_cridex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_cridex.py)|Create Mutex (C0042)|--|
-|[fonix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/fonix_mutexes.py)|Create Mutex (C0042)|--|
-|[germanwiper_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/germanwiper_mutexes.py)|Create Mutex (C0042)|--|
-|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ratsnif_mutexes.py)|Create Mutex (C0042)|--|
-|[crat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/crat_mutexes.py)|Create Mutex (C0042)|--|
-|[neshta_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_mutexes.py)|Create Mutex (C0042)|--|
-|[banker_spyeye_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_spyeye_mutexes.py)|Create Mutex (C0042)|--|
-|[powerpool_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powerpool_mutexes.py)|Create Mutex (C0042)|--|
-|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Create Mutex (C0042)|--|
-|[deepfreeze_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deepfreeze_mutex.py)|Create Mutex (C0042)|--|
-|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_xtreme_mutexes.py)|Create Mutex (C0042)|--|
-|[lokibot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/lokibot_mutexes.py)|Create Mutex (C0042)|--|
-|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_mutexes.py)|Create Mutex (C0042)|--|
-|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_plugx_mutexes.py)|Create Mutex (C0042)|--|
-|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_mutexes.py)|Create Mutex (C0042)|--|
-|[cypherit_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cypherit_mutexes.py)|Create Mutex (C0042)|--|
-|[protonbot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/protonbot_mutexes.py)|Create Mutex (C0042)|--|
-|[cryptomix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomix_mutexes.py)|Create Mutex (C0042)|--|
-|[phorpiex_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/phorpiex_mutexes.py)|Create Mutex (C0042)|--|
-|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/venomrat_mutexes.py)|Create Mutex (C0042)|--|
-|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_mutexes.py)|Create Mutex (C0042)|--|
-|[andromut_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/andromut_mutexes.py)|Create Mutex (C0042)|--|
-|[azorult_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/azorult_mutexes.py)|Create Mutex (C0042)|--|
-|[dharma_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dharma_mutexes.py)|Create Mutex (C0042)|--|
-|[rat_quasar_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_quasar_mutexes.py)|Create Mutex (C0042)|--|
-|[bot_russkill](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_russkill.py)|Create Mutex (C0042)|--|
-|[snake_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/snake_ransom_mutexes.py)|Create Mutex (C0042)|--|
-|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_mutexes.py)|Create Mutex (C0042)|--|
-|[qulab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/qulab_mutexes.py)|Create Mutex (C0042)|--|
-|[allaple_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/allaple_mutexes.py)|Create Mutex (C0042)|--|
-|[banker_zeus_p2p](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_p2p.py)|Create Mutex (C0042)|--|
-|[carberp_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/carberp_mutex.py)|Create Mutex (C0042)|--|
-|[rat_poisonivy_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_poisonivy_mutexes.py)|Create Mutex (C0042)|--|
-|[satan_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/satan_mutexes.py)|Create Mutex (C0042)|--|
-|[medusalocker_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_mutexes.py)|Create Mutex (C0042)|--|
-|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_mutexes.py)|Create Mutex (C0042)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[allaple_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/worm_allaple_mutex.py)|AllapleMutexes|Create Mutex (C0042)|--|
+|[andromut_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/downloader_andromut_mutex.py)|AndromutMutexes|Create Mutex (C0042)|--|
+|[asyncrat_mutex_raccoon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_raccoon.py)|RaccoonInfoStealerMutex|Create Mutex (C0042)|--|
+|[asyncrat_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/asyncrat_mutex.py)|AsyncRatMutex|Create Mutex (C0042)|--|
+|[azorult_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_azorult_mutex.py)|AzorultMutexes|Create Mutex (C0042)|--|
+|[banker_cridex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_cridex.py)|Cridex|Create Mutex (C0042)|--|
+|[banker_spyeye_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_spyeye_mutex.py)|SpyEyeMutexes|Create Mutex (C0042)|--|
+|[banker_zeus_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_zeus_mutex.py)|ZeusMutexes|Create Mutex (C0042)|--|
+|[banker_zeus_p2p](https://github.com/CAPESandbox/community/blob/master/modules/signatures/all/banker_zeus_p2p.py)|ZeusP2P|Create Mutex (C0042)|--|
+|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|BlackRATMutexes|Create Mutex (C0042)|--|
+|[bot_russkill](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bot_russkill.py)|Ruskill|Create Mutex (C0042)|--|
+|[carberp_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/carberp_mutex.py)|CarberpMutexes|Create Mutex (C0042)|--|
+|[crat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_crat.py)|CRATMutexes|Create Mutex (C0042)|--|
+|[cryptomix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_cryptomix.py)|CryptoMixMutexes|Create Mutex (C0042)|--|
+|[cypherit_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cypherit_mutex.py)|CypherITMutexes|Create Mutex (C0042)|--|
+|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_dcrat.py)|DCRatMutex|Create Mutex (C0042)|--|
+|[deepfreeze_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deepfreeze_mutex.py)|DeepFreezeMutex|Create Mutex (C0042)|--|
+|[dharma_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_dharma.py)|DharmaMutexes|Create Mutex (C0042)|--|
+|[fleercivet_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trojan_fleercivet_mutex.py)|FleerCivetMutexes|Create Mutex (C0042)|--|
+|[fonix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_fonix_mutex.py)|FonixMutexes|Create Mutex (C0042)|--|
+|[gandcrab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_gandcrab.py)|GandCrabMutexes|Create Mutex (C0042)|--|
+|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Geodo|Create Mutex (C0042)|--|
+|[germanwiper_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_germanwiper.py)|GermanWiperMutexes|Create Mutex (C0042)|--|
+|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|LimeRATMutexes|Create Mutex (C0042)|--|
+|[lokibot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trojan_lokibot_mutex.py)|LokibotMutexes|Create Mutex (C0042)|--|
+|[medusalocker_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_medusalocker.py)|MedusaLockerMutexes|Create Mutex (C0042)|--|
+|[nemty_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_nemty.py)|NemtyMutexes|Create Mutex (C0042)|--|
+|[neshta_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/virus_neshta.py)|NeshtaMutexes|Create Mutex (C0042)|--|
+|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_oblique.py)|ObliquekRATMutexes|Create Mutex (C0042)|--|
+|[okrum_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/backdoor_okrum_mutex.py)|OkrumMutexes|Create Mutex (C0042)|--|
+|[packer_armadillo_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/packer_armadillo_mutex.py)|ArmadilloMutex|Create Mutex (C0042)|--|
+|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_parallax_mutex.py)|ParallaxMutexes|Create Mutex (C0042)|--|
+|[phorpiex_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/downloader_phorpiex_mutex.py)|PhorpiexMutexes|Create Mutex (C0042)|--|
+|[powerpool_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powerpool_mutex.py)|PowerpoolMutexes|Create Mutex (C0042)|--|
+|[protonbot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/downloader_protonbot_mutex.py)|ProtonBotMutexes|Create Mutex (C0042)|--|
+|[pysa_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_pysa_mutex.py)|PYSAMutexes|Create Mutex (C0042)|--|
+|[qulab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_qulab.py)|QulabMutexes|Create Mutex (C0042)|--|
+|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_radamant.py)|RansomwareRadamant|Create Mutex (C0042)|--|
+|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_beebus_mutex.py)|BeebusMutexes|Create Mutex (C0042)|--|
+|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_fynloski_mutex.py)|FynloskiMutexes|Create Mutex (C0042)|--|
+|[rat_luminosity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_luminosity.py)|LuminosityRAT|Create Mutex (C0042)| CryptHashData, NtCreateMutant|
+|[rat_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_nanocore.py)|NanocoreRAT|Create Mutex (C0042)|--|
+|[rat_pcclient](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_pcclient.py)|PcClientMutexes|Create Mutex (C0042)|--|
+|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_plugx_mutex.py)|PlugxMutexes|Create Mutex (C0042)|--|
+|[rat_poisonivy_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_poisonivy.py)|PoisonIvyMutexes|Create Mutex (C0042)|--|
+|[rat_quasar_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_quasar.py)|QuasarMutexes|Create Mutex (C0042)|--|
+|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_spynet.py)|SpynetRat|Create Mutex (C0042)|--|
+|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xtreme_mutex.py)|XtremeMutexes|Create Mutex (C0042)|--|
+|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_ratsnif_mutex.py)|RatsnifMutexes|Create Mutex (C0042)|--|
+|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|RemcosMutexes|Create Mutex (C0042)|--|
+|[renamer_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/virus_renamer_mutex.py)|RenamerMutexes|Create Mutex (C0042)|--|
+|[revil_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_revil_mutex.py)|RevilMutexes|Create Mutex (C0042)|--|
+|[satan_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_satan_mutex.py)|SatanMutexes|Create Mutex (C0042)|--|
+|[snake_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_snake_mutex.py)|SnakeRansomMutexes|Create Mutex (C0042)|--|
+|[stop_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_stop.py)|StopRansomMutexes|Create Mutex (C0042)|--|
+|[targeted_flame](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/targeted_flame.py)|Flame|Create Mutex (C0042)|--|
+|[trickbot_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trickbot_mutex.py)|TrickBotMutexes|Create Mutex (C0042)|--|
+|[ursnif_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trojan_ursnif.py)|UrsnifBehavior|Create Mutex (C0042)|--|
+|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_venom.py)|VenomRAT|Create Mutex (C0042)|--|
+|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xpert.py)|XpertRATMutexes|Create Mutex (C0042)|--|![image](https://github.com/user-attachments/assets/c0dc90a3-80a1-4ce2-9ba9-5eae9c7852b7)
 
 ### C0042 Snippet
 <details>

micro-behaviors/process/create-process.md

@@ -62,18 +62,18 @@ Malware creates a process.
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[create process on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-windows.yml)|Create Process (C0017)|kernel32.WinExec, kernel32.CreateProcess, shell32.ShellExecute, shell32.ShellExecuteEx, advapi32.CreateProcessAsUser, advapi32.CreateProcessWithLogon, advapi32.CreateProcessWithToken, kernel32.CreateProcessInternal, ntdll.NtCreateUserProcess, ntdll.NtCreateProcess, ntdll.NtCreateProcessEx, ntdll.ZwCreateProcess, ZwCreateProcessEx, ntdll.ZwCreateUserProcess, ntdll.RtlCreateUserProcess, System.Diagnostics.Process::Start|
-|[create process on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-linux.yml)|Create Process (C0017)|execve, execl, execlp, execle, execv, execvp, execvpe, posix_spawn, posix_spawnp, popen|
+|[create process on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-linux.yml)|Create Process (C0017)|execve, execl, execlp, execle, execv, execvp, execvpe, posix_spawn, posix_spawnp, popen, fork|
 |[execute command](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/execute-command.yml)|Create Process (C0017)|system, _system, wsystem, _wsystem|
 |[create a process with modified I/O handles and window](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml)|Create Process (C0017)|kernel32.CreateProcess, kernel32.CreateProcessInternal, advapi32.CreateProcessAsUser, advapi32.CreateProcessWithLogon, advapi32.CreateProcessWithToken, kernel32.GetStartupInfo, System.Diagnostics.Process::Start|
 |[create process suspended](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-suspended.yml)|Create Process::Create Suspended Process (C0017.003)|kernel32.CreateProcess, advapi32.CreateProcessAsUser|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[stealth_system_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_system_procname.py)|Create Process (C0017)|ShellExecuteExW, CreateProcessInternalW|
-|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_process_create.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW|
-|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_create_process.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW|
-|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_create_process.py)|Create Process::Create Process via WMI (C0017.002)|NtCreateUserProcess, CreateProcessInternalW|
-|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_created_process.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[stealth_system_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_system_procname.py)|StealthSystemProcName|Create Process (C0017)|ShellExecuteExW, CreateProcessInternalW|
+|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|StackPivotProcessCreate|Create Process (C0017)|CreateProcessInternalW,  NtCreateUserProcess|
+|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wmi.py)|WMICreateProcess|Create Process (C0017)| CreateProcessInternalW, NtCreateUserProcess|
+|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wmi.py)|WMICreateProcess|Create Process::Create Process via WMI (C0017.002)| CreateProcessInternalW, NtCreateUserProcess|
+|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|ScriptCreatedProcess|Create Process (C0017)|CreateProcessInternalW, NtCreateUserProcess|
 
 ### C0049 Snippet
 <details>

micro-behaviors/process/create-thread.md

@@ -48,11 +48,11 @@ Malware creates a thread.
 |[create thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/create/create-thread.yml)|Create Thread (C0038)|kernel32.CreateThread, _beginthread, _beginthreadex, PsCreateSystemThread, SHCreateThread, SHCreateThreadWithHandle, kernel32.CreateRemoteThread, kernel32.CreateRemoteThreadEx, RtlCreateUserThread, ntdll.NtCreateThread, ntdll.NtCreateThreadEx, ntdll.ZwCreateThread, ntdll.ZwCreateThreadEx, pthread_create, System.Threading.Thread::Start, System.Threading.Thread::ctor|
 |[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Create Thread (C0038)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[injection_create_remote_thread](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Create Thread (C0038)|--|
-|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntcreatethreadex.py)|Create Thread (C0038)|NtCreateThreadEx|
-|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Create Thread (C0038)|NtSetInformationThread|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[injection_create_remote_thread](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_InjectionCreateRemoteThread|Create Thread (C0038)|--|
+|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntcreatethreadex.py)|antidebug_ntcreatethreadex|Create Thread (C0038)|NtCreateThreadEx|
+|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntsetinformationthread.py)|antidebug_ntsetinformationthread|Create Thread (C0038)|NtSetInformationThread|
 
 ### C0038 Snippet
 <details>

micro-behaviors/process/set-thread-local-storage-value.md

@@ -45,7 +45,7 @@ Malware allocates thread local storage.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue|
+|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/tls/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue|
 
 ### C0041 Snippet
 <details>

micro-behaviors/process/synchronization.md

@@ -1,37 +0,0 @@
-<table>
-<tr>
-<td><b>ID</b></td>
-<td><b>C0022</b></td>
-</tr>
-<tr>
-<td><b>Objective(s)</b></td>
-<td><b><a href="../process">Process</a></b></td>
-</tr>
-<tr>
-<td><b>Related ATT&CK Techniques</b></td>
-<td><b>None</b></td>
-</tr>
-<tr>
-<td><b>Version</b></td>
-<td><b>2.0</b></td>
-</tr>
-<tr>
-<td><b>Created</b></td>
-<td><b>14 August 2020</b></td>
-</tr>
-<tr>
-<td><b>Last Modified</b></td>
-<td><b>10 November 2022</b></td>
-</tr>
-</table>
-
-
-# Synchronization
-
-Malware enables two or more processes/threads to share a resource. 
-
-## Methods
-
-|Name|ID|Description|
-|---|---|---|
-|**Create Mutex**|C0022.001|Malware creates a mutex to enable synchronization.|

micro-behaviors/process/terminate-process.md

@@ -52,9 +52,9 @@ Malware terminates a process.
 |[terminate process via kill](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process-via-kill.yml)|Terminate Process (C0018)|kill|
 |[terminate process](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process.yml)|Terminate Process (C0018)|System.Diagnostics.Process::Kill, System.Diagnostics.Process::WaitForExit, System.Diagnostics.Process::WaitForExitAsync, System.Environment::Exit, System.Windows.Forms.Application::Exit, kernel32.TerminateProcess, ntdll.NtTerminateProcess, kernel32.ExitProcess|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[terminates_remote_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/terminates_remote_process.py)|Terminate Process (C0018)|NtTerminateProcess|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[terminates_remote_process](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/terminates_process.py)|TerminatesRemoteProcess|Terminate Process (C0018)|NtTerminateProcess|
 
 ### C0018 Snippet
 <details>

revoked.md

@@ -0,0 +1,10 @@
+# Revoked Behaviors and Methods
+The Malware Behavior Catalog has revoked a small number of behaviors and methods as it has evolved.  The IDs for revoked behaviors and methods are not re-used.  If it appears that we are missing behavior or methods IDs, this page will explain what revoked IDs previously represented, when they were retired, and the reason for retiring them.
+
+| Revoked ID | Behavior or Method | Revocation Date | Reason |
+|--- |--- |--- |--- |
+| C0013 | UDP Communication | 25 September 2020 | Merged into C0001 because UDP also communicates over socket interfaces |
+| B0001.007 | Interrupt 1 | 2 August 2022 | Merged into B0001.006 to create a more general 'Interruption' method |
+| B0012.004 | Variable Recomposition | 21 November 2022 | Moved to B0032.021 |
+| C0032.004 | Verhoeff | 1 February 2023 | Not actually used in malware |
+| E1608 | Install Certificate | 14 February 2024 | Changed from enhanced ATT&CK technique ID (E-prefix) to enhanced ATT&CK sub-technique ID (F-prefix).  Current ID is F0016 |

xample-malware/dnschanger.md

@@ -37,13 +37,6 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev
 |[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|DNSChanger sets file attributes. [[2]](#2)|
 |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|DNSChanger accesses PE headers. [[2]](#2)|
 
-## ATT&CK Techniques
-
-|Name|Use|
-|---|---|
-|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[2]](#2)|
-|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[2]](#2)|
-
 ## Enhanced ATT&CK Techniques
 
 |Name|Use|

xample-malware/emotet.md

@@ -45,13 +45,6 @@ Emotet is a banking trojan. [[1]](#1)
 |[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [[1]](#1)|
 |[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Emotet writes clipboard data. [[6]](#6)|
 
-|Name|Use|
-|---|---|
-|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2)|
-|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2)|
-|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1)|
-|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6)|
-
 ## MBC Behaviors
 
 |Name|Use|

xample-malware/gamut.md

@@ -62,7 +62,7 @@ Gamut is a spamming botnet.
 |[Impact::Spamming (B0039)](../impact/spamming.md)|If port 25 is open, the bot uses a spam template and email list to send spam. [[1]](#1)|
 |[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Gamut hashes data with CRC32. [[3]](#3)|
 |[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Gamut encodes data using XOR. [[3]](#3)|
-|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[3]](#3)|
+|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Gemut enumerates PE sections. [[3]](#3)|
 |[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Gamut contains an embedded PE file. [[3]](#3)|
 |[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Gamut creates directories. [[3]](#3)|
 |[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Gamut deletes directories. [[3]](#3)|

xample-malware/snake.md

@@ -9,7 +9,7 @@
 </tr>
 <tr>
 <td><b>Aliases</b></td>
-<td><b>None</b></td>
+<td><b>Uroburos</b></td>
 </tr>
 <tr>
 <td><b>Platforms</b></td>
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Associated ATT&CK Software</b></td>
-<td><b>None</b></td>
+<td><b>Uroburos</b></td>
 </tr>
 </table>
 
@@ -30,12 +30,36 @@
 
 The Snake malware is an information-stealing malware that is implemented in the .NET programming language. It has been in use since 2004 and is one of the most sophisticated cyber espionage tools designed and used by Russia's FSB for long-term intelligence collection. [[1]](#1)
 
+## ATT&CK Techniques
+
+See ATT&CK: [Uroburos](https://attack.mitre.org/software/S0022/)
+
+## Enhanced ATT&CK Techniques
+
+|Name|Use|
+|---|---|
+|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)| The Snake malware is distributed in a packed format [[1]](#1)|
+|[Anti-Static Analysis::Software Packing::Confuser (F0001.009)](../anti-static-analysis/software-packing.md)| Some analyzed Snake samples have been packed with Confuser [[2]](#2)|
+|[Defense Evasion::Self-Deletion (F0007)](../defense-evasion/self-deletion.md)| Snake can delete itself to prevent detection. [[1]](#1)|
+|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)| Snake collects information about the host on which it is running and its probable geographic location. [[1]](#1)|
+|[Collection::Keylogging::Application Hook (F0002.001)](../collection/keylogging.md)| Snake uses SetWindowsHookExA to monitor for and log keystrokes. [[1]](#1)|
+|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)| Snake captures screenshots. [[1]](#1)|
+
 ## MBC Behaviors
 
 |Name|Use|
 |---|---|
-|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)|Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
+|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)| Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
+|[Data::Decode Data::Base64 (C0053.001)](../micro-behaviors/data/decode-data.md)| Snake decodes information stored in base64 during the unpacking process observed in [[1]](#1)|
+|[Cryptography::Decrypt Data::3DES (C0031.005)](../micro-behaviors/cryptography/decrypt-data.md)| Snake decrypts a .NET assembly encrypted with 3DES during the unpacking process observed in [[1]](#1)|
+|[Cryptography::Decrypt Data::AES (C0031.001)](../micro-behaviors/cryptography/decrypt-data.md)| Snake decrypts credentials stored in web browsers using AES. [[1]](#1)|
+|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)| Snake copies its executable to another location while establishing persistence. [[1]](#1)|
+|[File System::Create File (C0016)](../micro-behaviors/file-system/create-file.md)| Snake creates a scheduled task configuration file [[1]](#1)|
+|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)| Snake can delete image files created when screenshots are captured. [[1]](#1)|
+|[Cryptography::Crypto Library::API Call (C0059.001)](../micro-behaviors/cryptography/crypto-library.md)| Snake uses the Network Security Services library to decrypt some credentials stored in browsers. [[1]](#1)|
 
 ## References
 
 <a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+
+<a name="2">[2]</a> https://threatresearch.ext.hp.com/the-many-skins-of-snake-keylogger/

yfaq/references_to_mbc.md

@@ -1,21 +1,36 @@
 # MBC in the Wild
 
-The following table contains community references to MBC:
+The following table lists papers and presentations that reference MBC.
 
 | Date | Reference |
 |------|-----------|
-| Aug 2022 | AccidentalRebel, “Talking about Mitre's Malware Behavior Catalog” Blackhat Middle East & Africa community meetup lightning talk, 2022. https://www.accidentalrebel.com/talking-about-mitres-malware-behavior-catalog.html   |
-| Dec 2021 | L.F. Martin, “PIFMANA: Pipeline for Malware Analysis,” Master Thesis, Universitat Oberta de Catalunya, 2021.                                                                                                                |
-| Dec 2021 | K. Oosthoek and C. Doerr, "Inside the Matrix: CTI Frameworks as Partial Abstractions of Complex Threats," 2021 IEEE International Conference on Big Data (Big Data), 2021.                                                  |
-| Dec 2021 | M. R. Smith et al., "Malware Generation with Specific Behaviors to Improve Machine Learning-based Detection," 2021 IEEE International Conference on Big Data (Big Data), 2021.                                              |
-| Nov 2021 | K. Licudine, Blackhat Middle East community meetup presentation. https://www.linkedin.com/posts/juan-karlo-licudine_malware-community-middleeast-activity-6958155280530456576-UUlb/                                         |
-| Nov 2021 | F. Bilstein, “Capability Analysis of Malicious Software,” Universitat Bonn, Nov 2021 (advisor: Daniel Plohmann, Malpedia)                                                                                                   |
+| May 2024 | M. Beninger et al, “ERSO: Enhancing Military Cybersecurity with AI-Driven SBOM for Firmware Vulnerability Detection and Asset Management,” CyCon 2024. https://ccdcoe.org/uploads/2024/05/CyCon_2024_Beninger_Charland_Ding_Fung-1.pdf ​|
+| Apr 2024 | A. Nadeem, “Understanding Adversary Behavior via XAI: Leveraging Sequence Clustering To Extract Threat Intelligence,” Thesis, TU Delft. https://research.tudelft.nl/en/publications/understanding-adversary-behavior-via-xai-leveraging-sequence-clus ​|
+| Mar 2024 | A. Nair and G. Ramesh, “Ontology-Driven Behavioral Model for Ransomware Traceability.” https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4779064 ​|
+| Jan 2024 | A. Ruggia, “Unmasking the Veiled: A Comprehensive Analysis of Android Evasive Malware.” ​https://hal.science/hal-04378941/ |
+| Dec 2023 | D. Sim et al, “A SIEM and Multiple Analysis Software Integrated Malware Detection Approach.” https://ieeexplore.ieee.org/abstract/document/10425463 ​|
+| Aug 2023 | J. Liu et al, “MRm-DLDet: a memory-resident malware detection framework based on memory forensics and deep neural network.” https://link.springer.com/article/10.1186/s42400-023-00157-w ​|
+| Jul 2023​ | D. Beck, “Malware Behavior Catalog,” Poster at 14th Annual Malware TEM, Lawrence Livermore National Laboratory, 25-26 July 2023.​ |
+| Mar 2023​ | M. Smith et al, “All Models are Wrong, but Some(times) are Useful: Evaluating when Machine Learning Models are Useful for Detecting Novel Malware in the Wild,” Sandia NL, 2022. https://www.osti.gov/servlets/purl/2005426​ |
+| Mar 2023​ | S. Kumari, “TRY HACK ME: Basic Static Analysis Write-Up,” Medium, 3/13/2023. https://medium.com/@kumarishefu.4507/try-hack-me-basic-static-analysis-write-up-500b0e23792d ​|
+| Feb 2023​ | L. Zeltser, “SANS DFIR Malware Analysis Tips and Tricks Poster.” https://www.sans.org/posters/malware-analysis-tips-tricks-poster/ ​|
+| Oct 2022​ | M. Smith, “MalGen: Malware Generation with Specific Behaviors to Improve Machine Learning-based Detectors.” https://www.osti.gov/biblio/1893244 ​|
+| Sep 2022 | R. Marinho et al, ”Introdução à Análise de Códigos Maliciosos para ambiente Windows.” https://sol.sbc.org.br/livros/index.php/sbc/catalog/download/107/479/752-1 ​|
+| Aug 2022 | AccidentalRebel, “Talking about Mitre's Malware Behavior Catalog” Blackhat Middle East & Africa community meetup lightning talk, 2022. https://www.accidentalrebel.com/talking-about-mitres-malware-behavior-catalog.html |
+| Jul 2022​ | K. Licudine, “MBCScan,” scans a file for MBC behaviors. https://github.com/accidentalrebel/mbcscan ​|
+| May 2022​ | “Hackers-Tools.” https://github.com/Willian-2-0-0-1/Hacker-s-Tools-/blob/main/README.md ​|
+| Dec 2021 | L.F. Martin, “PIFMANA: Pipeline for Malware Analysis,” Master Thesis, Universitat Oberta de Catalunya, 2021. |
+| Dec 2021 | K. Oosthoek and C. Doerr, "Inside the Matrix: CTI Frameworks as Partial Abstractions of Complex Threats," 2021 IEEE International Conference on Big Data (Big Data), 2021. |
+| Dec 2021 | M. R. Smith et al., "Malware Generation with Specific Behaviors to Improve Machine Learning-based Detection," 2021 IEEE International Conference on Big Data (Big Data), 2021. |
+| Nov 2021 | K. Licudine, Blackhat Middle East community meetup presentation. https://www.linkedin.com/posts/juan-karlo-licudine_malware-community-middleeast-activity-6958155280530456576-UUlb/ |
+| Nov 2021 | F. Bilstein, “Capability Analysis of Malicious Software,” Universitat Bonn, Nov 2021 (advisor: Daniel Plohmann, Malpedia) |
 | Oct 2021 | M. M. Islam, A. Dutta, M. S. I. Sajid, E. Al-Shaer, J. Wei and S. Farhang, "CHIMERA: Autonomous Planning and Orchestration for Malware Deception," 2021 IEEE Conference on Communications and Network Security (CNS), 2021. |
-| Sep 2021 | D. Beck, “Malware Behavior Catalog,” DoD/NNSA SwA CoP 2021, Sept 2021.                                                                                                                                                      |
-| Jul 2021 | N. Johnson, “Going Beyond Signature Malware Detection by Learning Behaviors,” Sandia. SAND2021-8104C.                                                                                                                       |
-| Nov 2020 | M.R. Smith et al, “Mind the Gap: On Bridging the Semantic Gap between Machine Learning and Information Security,” AISec ’20, 13 Nov 2020.                                                                                   |
-| Oct 2020 | D. Beck, “Standardized Reporting with MBC,” VB2020 localhost                                                                                                                                                                |
-| May 2020 | M.R. Smith et al, “Mind the Gap: On Bridging the Semantic Gap between Machine Learning and Information Security,” arXivLabs, May 2020.                                                                                      |
-| Oct 2019 | D. Beck, “Malware Behavior Catalog,” BSidesDC, Oct 2019.                                                                                                                                                                    |
-| Jul 2019 | D. Beck, “Malware Behavior Catalog,” MTEM, July 2019.                                                                                                                                                                       |
-| Jun 2019 | K. O’Meara, “Behavioral Matrix and Tool Analysis of Energetic Bear and GreyEnergy Actor,” SEI CERT Coordination Center, June 2019.                                                                                          |
+| Sep 2021 | D. Beck, “Malware Behavior Catalog,” DoD/NNSA SwA CoP 2021, Sept 2021. |
+| Jul 2021 | N. Johnson, “Going Beyond Signature Malware Detection by Learning Behaviors,” Sandia. SAND2021-8104C. |
+| Apr 2021​ | K. Licudine, “mbclib,” library for querying the STIX data for MBC. https://pypi.org/project/mbclib/#description ​|
+| Nov 2020 | M.R. Smith et al, “Mind the Gap: On Bridging the Semantic Gap between Machine Learning and Information Security,” AISec ’20, 13 Nov 2020. |
+| Oct 2020 | D. Beck, “Standardized Reporting with MBC,” VB2020 localhost.   |
+| May 2020 | M.R. Smith et al, “Mind the Gap: On Bridging the Semantic Gap between Machine Learning and Information Security,” arXivLabs, May 2020. |
+| Oct 2019 | D. Beck, “Malware Behavior Catalog,” BSidesDC, Oct 2019.  |
+| Jul 2019 | D. Beck, “Malware Behavior Catalog,” MTEM, July 2019.  |
+| Jun 2019 | K. O’Meara, “Behavioral Matrix and Tool Analysis of Energetic Bear and GreyEnergy Actor,” SEI CERT Coordination Center, June 2019. |

ynewsletters/12092024.md

@@ -0,0 +1,15 @@
+# <a name="faq"></a>Malware Behavior Catalog Newsletter # 
+**December 9, 2024**
+
+Hello everyone!
+
+Here are recent MBC developments:
+
+* Released [MBC 3.2](https://github.com/MBCProject/mbc-markdown/releases/tag/v3.2).
+* Released the [STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2.1) for MBC 3.2, which is based on the [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9).
+* Updated the [visual representation](https://raw.githubusercontent.com/MBCProject/mbc-markdown/master/yfaq/mbc_matrix_with_ids.svg) of MBC.
+* Updated MBC-CAPE signature mappings/links (thanks @RazviOverflow!)
+* Added new method: Anti-Static Analysis::Disassembler Evasion::Fake Function (thanks @utkonos!)
+* Reviewed capa to identify mapping suggestions (none found).
+
+Please post questions or comments in [Discussions](https://github.com/MBCProject/mbc-markdown/discussions) on GitHub, or email us at mbc@mitre.org. Feedback is always appreciated! 

ynewsletters/README.md

@@ -1,5 +1,7 @@
 ## <a name="faq"></a>Malware Behavior Catalog Newsletters ##
 
+<a href="./12092024.md">December 2024</a>
+
 <a href="./05012024.md">May 2024</a>
 
 <a href="./12182023.md">December 2023</a>

yvisualization/README.md

@@ -0,0 +1,103 @@
+# Malware Behavior Visualization
+
+We investigated the [STIX Visualizer (STIXviz)](https://github.com/oasis-open/cti-stix-visualization) and the [Attack Flow Builder (AFB)](https://github.com/center-for-threat-informed-defense/attack-flow) for visualizing malware behaviors as defined by MBC and ATT&CK. We assume the reader is familiar with [Structured Threat Information Expression (STIX)](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html) (a language and serialization format used to exchange cyber threat intelligence) and [Attack Flow](https://github.com/center-for-threat-informed-defense/attack-flow) (a language for describing how cyber adversaries combine and sequence offensive techniques to achieve their goals).
+
+**Choosing between STIXviz and AFB**
+
+The STIXviz user interface is more advanced than AFB's, so if STIX content is available or easy for the user to generate, STIXviz may be the better option. However, creating a behavior graph when a STIX representation is not available is much easier with AFB. 
+
+Other considerations:
+- Both tools offer unique advantages and may be best used in combination. 
+- Capturing temporal flow/chronology is easy in AFB (AFB was designed for "flows").
+- AFB relationships are very basic compared to STIX Relationship Objects (SROs).
+- For someone familiar with STIX, building a graph in AFB may take more time than generating STIX.
+- AFB can be used as a tool for generating STIX. The AFB "Publish Attack Flow" option produces a STIX bundle. The resulting JSON output is not fully aligned with STIX (for example, STIX Relationship Objects are missing) but the output is a good start and can be displayed in STIXviz. 
+
+## Example Behavior Graphs 
+
+**IcedID**
+
+- [Source blog](https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise)
+- [AFB graph](./attack-flow-builder/icedid/IcedID-032725.png) (image)
+- [STIX graph](./stix-visualizer/icedid/icedid-viz.png) (image)
+- [.afb file](./attack-flow-builder/icedid/IcedID-032725.afb) (loadable into AFB)
+- [STIX JSON file](./stix-visualizer/icedid/icedid-stix.json) (loadable into STIXviz)
+
+**Lactrodectus**
+
+- [Source blog](https://www.bitsight.com/blog/latrodectus-are-you-coming-back)
+- [AFB graph](./attack-flow-builder/latrodectus/Latrodectus-032725.png) (image)
+- [STIX graph](./stix-visualizer/latrodectus/latrodectus-viz.png) (image)
+- [.afb file](./attack-flow-builder/latrodectus/Latrodectus-032725.afb) (loadable into AFB)
+- [STIX JSON file](./stix-visualizer/latrodectus/latrodectus-stix.json) (loadable into STIXviz)
+
+## **[STIX Visualizer](https://github.com/oasis-open/cti-stix-visualization)**
+The STIX Visualizer (STIXviz) displays STIX content supported by various schemas. Malware analysis information should be captured in STIX using the [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9); details and its schema are available in the [OASIS Common Object Repository (COR)](https://github.com/oasis-open/cti-stix-common-objects/tree/main).
+
+**Resources**
+
+- [STIXviz online](https://oasis-open.github.io/cti-stix-visualization/) 
+- [STIXviz download](https://github.com/oasis-open/cti-stix-visualization)
+- [Malware Behavior Extension Definition Object](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9)
+- [Custom STIXviz configuration file](./stix-visualizer/stix2viz.js)
+- [Custom STIXViz icons](./stix-visualizer/mbc-icons)
+- [STIX Validator](https://github.com/oasis-open/cti-stix-validator)
+- [MBC STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2.1)
+- [ATT&CK STIX 2.0 representation](https://github.com/mitre/cti/tree/master/enterprise-attack)
+
+
+**Usage Notes**
+- For a node to be visable in STIXviz, the object's STIX JSON must be included in the STIX Bundle. The required JSON objects can be found in the STIX 2 representations for [MBC](https://github.com/MBCProject/mbc-stix2.1) and [ATT&CK](https://github.com/mitre/cti/tree/master/enterprise-attack).
+- A custom STIXviz [configuation file](./stix-visualizer/stix2viz.js) is needed to display MBC content.
+- A custom set of [MBC icons](./stix-visualizer/mbc-icons.js) is available for displaying MBC content in STIXViz.  Otherwise, STIXviz will use a generic marker for all the object types it does not recognize.
+
+**Best Practices**
+
+- Use STIX Relationship Objects (SROs) to show chronology between behaviors. 
+    - For example, Behavior "leads-to" Behavior.
+    - Relationship types are not defined in the malware behavior extension, but the *relationship_type* property can be any string. 
+    - Explicit relationships between Behavior objects may be defined in a future version of the extension.
+- Use SROs to capture relationships between Behavior and Malware objects. 
+    - For example, a Behavior "delivers" Malware. 
+- Use SROs to capture relationships between Malware objects
+    - For example, Malware "drops" Malware.
+- Use SROs to capture chronology information.
+    - For example, Behavior "leads-to" Behavior.
+    - The *created* and *modified* common properties could be used to capture chronology, but the properties are not displayed in the STIXviz graph.
+- Use Grouping objects to specify AND and OR operations. 
+    - The *context* property is set equal to "and" or "or." 
+    - All objects referenced in a Grouping *object_refs* property are those being and-ed or or-ed. 
+    - An SRO would be defined as a Behavior "chooses-from" Grouping.
+- Use Grouping objects to capture components of modular malware or sets of C2 commands 
+    - The *context* is set equal to "chooses-from".
+- Use an SRO to capture a conditional operation.
+    - Behavior "if-true" Behavior and Behavior "if-false" Behavior. 
+- Use an Incident object (and associated Event and Impact objects) when capturing objects such as Threat Actors and Indicators.
+    - See the [Incident Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/incident-ef7) in the OASIS Common COR.
+
+
+## **[Attack Flow Builder](https://github.com/center-for-threat-informed-defense/attack-flow)** 
+The Attack Flow Builder allows a user to build a graph by inserting nodes and edges. Nodes can be Attack Flow objects (Action, Asset, AND/OR operators, and a Conditional object), STIX Domain Objects (SDOs), or STIX Cyber Observables (SCOs). The Attack Flow team defined a [STIX Extension Definition](https://github.com/center-for-threat-informed-defense/attack-flow/tree/main/stix) so that an AFB diagram can be saved as a STIX Bundle.
+
+**Resources**
+
+- [Online AFB tool](https://center-for-threat-informed-defense.github.io/attack-flow/ui/)
+- [AFB STIX Extension Definition Object](https://github.com/center-for-threat-informed-defense/attack-flow/tree/main/stix)
+- [Attack Flow STIX schema](https://github.com/center-for-threat-informed-defense/attack-flow/tree/main/stix)     
+
+**Usage Notes**
+
+- ATT&CK Tactics and Techniques are available in property drop-down menus.
+- MBC Behaviors, Methods, and Objectives must be manually entered.
+- Any Action node without an incoming edge is considered a start_ref to the Flow.
+- AFB relationships are all generic "related-to" (i.e., relationships have no properties).
+- In the STIX output, relationships are only created between Attack Flow objects (Actions, Assets).
+- The STIXviz configuration file would need to be modified to fully display Attack Flow objects.
+
+**Best Practices**
+
+- Use the description field for details that will help the viewer's understanding.
+- When capturing ATT&CK content, Action objects are better than STIX objects because they offer drop-down menus of ATT&CK Tactics and Techniques.
+- MBC content should be captured with Action objects to align with the capture of ATT&CK content. 
+- STIX Observables should be used instead of AFB Assets because they have more properties for capturing details.
+- An AFB graph may be disconnected (a collection of subgraphs) when capturing individual execution paths.

yvisualization/attack-flow-builder/icedid/IcedID-032725.json

@@ -0,0 +1,484 @@
+{
+  "type": "bundle",
+  "id": "bundle--e6c7f586-0ad8-4a0e-b2f8-b2c8ff9b4f19",
+  "spec_version": "2.1",
+  "created": "2025-03-31T13:11:04.256Z",
+  "modified": "2025-03-31T13:11:04.256Z",
+  "objects": [
+    {
+      "type": "extension-definition",
+      "id": "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "name": "Attack Flow",
+      "description": "Extends STIX 2.1 with features to create Attack Flows.",
+      "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "schema": "https://center-for-threat-informed-defense.github.io/attack-flow/stix/attack-flow-schema-2.0.0.json",
+      "version": "2.0.0",
+      "extension_types": [
+        "new-sdo"
+      ],
+      "external_references": [
+        {
+          "source_name": "Documentation",
+          "description": "Documentation for Attack Flow",
+          "url": "https://center-for-threat-informed-defense.github.io/attack-flow"
+        },
+        {
+          "source_name": "GitHub",
+          "description": "Source code repository for Attack Flow",
+          "url": "https://github.com/center-for-threat-informed-defense/attack-flow"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "name": "MITRE Center for Threat-Informed Defense",
+      "identity_class": "organization"
+    },
+    {
+      "type": "attack-flow",
+      "id": "attack-flow--49e4b0e6-5cc7-4757-81db-b1ae6788cd41",
+      "spec_version": "2.1",
+      "created": "2025-02-21T15:58:38.809Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "created_by_ref": "identity--4458ed6f-138c-4356-924e-c6ae5bc9db18",
+      "start_refs": [
+        "attack-action--ac0751dd-123e-488a-a093-6b5170f8e694",
+        "attack-action--eb5ca1e6-a396-4040-8318-436c3cce18e8"
+      ],
+      "name": "IcedID",
+      "description": "Visual displaying IcedID malware behavior",
+      "scope": "malware",
+      "external_references": [
+        {
+          "source_name": "THREAT ANALYSIS: From IcedID to Domain Compromise",
+          "url": "https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--4458ed6f-138c-4356-924e-c6ae5bc9db18",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "Maddie Bright"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--ac0751dd-123e-488a-a093-6b5170f8e694",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Malicious File",
+      "tactic_id": "TA0002",
+      "tactic_ref": "x-mitre-tactic--4ca45d45-df4d-4613-8980-bac22d278fa5",
+      "technique_id": "T1204.002",
+      "technique_ref": "attack-pattern--232b7f21-adf9-4b42-b936-b9d6f7df856e",
+      "description": "User executes a malicious archive",
+      "effect_refs": [
+        "attack-action--5ac84220-2268-4513-a117-dd38a5402739"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--5ac84220-2268-4513-a117-dd38a5402739",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Hidden Files and Directories",
+      "tactic_id": "TA0005",
+      "tactic_ref": "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
+      "technique_id": "T1564.001",
+      "technique_ref": "attack-pattern--ec8fc7e2-b356-455c-8db5-2e37be158e7d",
+      "description": "Archive contains a hidden file which is a dependency called by the visible LNK file"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--268f83ee-d3de-4320-bdde-ec6a04c46280",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Rundll32",
+      "tactic_id": "TA0005",
+      "tactic_ref": "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
+      "technique_id": "T1218.011",
+      "technique_ref": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5",
+      "description": "Used for executing DLL files",
+      "effect_refs": [
+        "attack-action--bae7ae51-0d92-4bcd-b0a1-8176fe231f3c"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--4c9d6521-a65b-4982-8c61-f03fd1494615",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Ingress Tool Transfer",
+      "tactic_id": "OB0004",
+      "technique_id": "E1105",
+      "effect_refs": [
+        "attack-action--c15548fd-3f78-41c1-88ce-b9b7ef361170"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--eb5ca1e6-a396-4040-8318-436c3cce18e8",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Executable Code Obfuscation",
+      "tactic_id": "OB0002",
+      "technique_id": "B0032",
+      "description": "File is obfuscated as demonstrated in the report"
+    },
+    {
+      "type": "file",
+      "id": "file--11f4d871-cc16-4e49-b4b1-528b361d9415",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "Twelfth.bat"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--1c8faaae-3d55-49ed-ba8d-e56f72d736bd",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Command and Scripting Interpreter",
+      "tactic_id": "OB0009",
+      "technique_id": "E1059",
+      "description": "bat file uses cmd.exe for executing further commands",
+      "effect_refs": [
+        "attack-action--bce4df0c-1803-4c08-b8b6-394e266ff38d"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--bae7ae51-0d92-4bcd-b0a1-8176fe231f3c",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Connect to Server",
+      "tactic_id": "OC0006",
+      "technique_id": "C0002.009",
+      "description": "connects to chronofire[.]info",
+      "effect_refs": [
+        "attack-action--4c9d6521-a65b-4982-8c61-f03fd1494615"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--bce4df0c-1803-4c08-b8b6-394e266ff38d",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Copy File",
+      "tactic_id": "OC0001",
+      "technique_id": "C0045",
+      "description": "Uses xcopy.exe",
+      "effect_refs": [
+        "attack-action--268f83ee-d3de-4320-bdde-ec6a04c46280"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--c15548fd-3f78-41c1-88ce-b9b7ef361170",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Rundll32",
+      "tactic_id": "TA0005",
+      "tactic_ref": "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
+      "technique_id": "T1218.011",
+      "technique_ref": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5",
+      "effect_refs": [
+        "attack-action--8814dbd7-b9c9-41a8-87f8-2a00c57d1d85",
+        "attack-action--eb109108-56ac-46e5-9d85-692afaa28a68"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--eb109108-56ac-46e5-9d85-692afaa28a68",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Decrypt Data",
+      "tactic_id": "OC0005",
+      "technique_id": "C0031",
+      "description": "Decryption key is file provided in initial archive"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--8814dbd7-b9c9-41a8-87f8-2a00c57d1d85",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Scheduled Task",
+      "tactic_id": "TA0003",
+      "tactic_ref": "x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92",
+      "technique_id": "T1053.005",
+      "technique_ref": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+      "description": "Executes xaeywn1.dll at every logon and every hour",
+      "effect_refs": [
+        "attack-action--a690f62f-30c3-4c78-a460-0779d8893282"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--5e395ad7-7b62-4876-b26c-2de21d8db034",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Connect to Server",
+      "tactic_id": "OC0006",
+      "technique_id": "C0002.009",
+      "description": "Domains observed were known to be connected to icedID",
+      "effect_refs": [
+        "attack-action--88bd84e5-e3b0-4dff-863e-5fedb8f4dc28"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--88bd84e5-e3b0-4dff-863e-5fedb8f4dc28",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Execute Shell Command",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.016",
+      "description": "Interactive remote shell session starts.  Attacker uses this to manually control malware."
+    },
+    {
+      "type": "file",
+      "id": "file--01b76ff0-5e05-491d-b188-94e3ecea47f8",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "superstring.dll"
+    },
+    {
+      "type": "file",
+      "id": "file--659602d1-d017-490b-8e31-68b567baa7ec",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "%TEMP%\\homesteading.dll"
+    },
+    {
+      "type": "file",
+      "id": "file--e91caa3d-6050-4df6-9428-dafc5415c8e4",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "xaeywn1.dll"
+    },
+    {
+      "type": "file",
+      "id": "file--9ec1e943-a76c-49ec-8a3d-b706eed5238e",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "init_dll_64.dll"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--a690f62f-30c3-4c78-a460-0779d8893282",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Rundll32",
+      "tactic_id": "TA0005",
+      "tactic_ref": "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
+      "technique_id": "T1218.011",
+      "technique_ref": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5",
+      "effect_refs": [
+        "attack-action--5e395ad7-7b62-4876-b26c-2de21d8db034"
+      ]
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--38d38edb-536e-45a8-8c93-59975d422ac3",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--5ac84220-2268-4513-a117-dd38a5402739",
+      "target_ref": "file--11f4d871-cc16-4e49-b4b1-528b361d9415"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--58038769-6a95-44bb-ba87-c7cd82309002",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--4c9d6521-a65b-4982-8c61-f03fd1494615",
+      "target_ref": "file--e91caa3d-6050-4df6-9428-dafc5415c8e4"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--e40259b3-205b-4263-a0fb-7937c8734bec",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--eb5ca1e6-a396-4040-8318-436c3cce18e8",
+      "target_ref": "file--11f4d871-cc16-4e49-b4b1-528b361d9415"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--ee51df71-182c-4d5d-8a4d-6aeec4ebe661",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--11f4d871-cc16-4e49-b4b1-528b361d9415",
+      "target_ref": "attack-action--1c8faaae-3d55-49ed-ba8d-e56f72d736bd"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--77e05fad-4cc6-4973-8b04-d874022723f1",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--bce4df0c-1803-4c08-b8b6-394e266ff38d",
+      "target_ref": "file--01b76ff0-5e05-491d-b188-94e3ecea47f8"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--f6621606-39b7-4b29-a867-1d79d57d8c64",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--eb109108-56ac-46e5-9d85-692afaa28a68",
+      "target_ref": "file--9ec1e943-a76c-49ec-8a3d-b706eed5238e"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--2d2883dc-d4ae-4fa0-9f1a-b027bbebc91c",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--01b76ff0-5e05-491d-b188-94e3ecea47f8",
+      "target_ref": "file--659602d1-d017-490b-8e31-68b567baa7ec"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--9548d521-fb15-455b-8119-d519b08027b4",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--659602d1-d017-490b-8e31-68b567baa7ec",
+      "target_ref": "attack-action--268f83ee-d3de-4320-bdde-ec6a04c46280"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--39bfb8bc-a964-45cf-a615-a7eea3b2bfcc",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--e91caa3d-6050-4df6-9428-dafc5415c8e4",
+      "target_ref": "attack-action--c15548fd-3f78-41c1-88ce-b9b7ef361170"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--43118de5-c0bc-404f-87fe-f123ce2d10db",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--9ec1e943-a76c-49ec-8a3d-b706eed5238e",
+      "target_ref": "attack-action--a690f62f-30c3-4c78-a460-0779d8893282"
+    }
+  ]
+}

yvisualization/attack-flow-builder/latrodectus/Latrodectus-032725.json

@@ -0,0 +1,749 @@
+{
+  "type": "bundle",
+  "id": "bundle--01ade9ab-1f53-4a2e-ad67-ec97110f0a16",
+  "spec_version": "2.1",
+  "created": "2025-03-31T13:09:11.852Z",
+  "modified": "2025-03-31T13:09:11.852Z",
+  "objects": [
+    {
+      "type": "extension-definition",
+      "id": "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "name": "Attack Flow",
+      "description": "Extends STIX 2.1 with features to create Attack Flows.",
+      "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "schema": "https://center-for-threat-informed-defense.github.io/attack-flow/stix/attack-flow-schema-2.0.0.json",
+      "version": "2.0.0",
+      "extension_types": [
+        "new-sdo"
+      ],
+      "external_references": [
+        {
+          "source_name": "Documentation",
+          "description": "Documentation for Attack Flow",
+          "url": "https://center-for-threat-informed-defense.github.io/attack-flow"
+        },
+        {
+          "source_name": "GitHub",
+          "description": "Source code repository for Attack Flow",
+          "url": "https://github.com/center-for-threat-informed-defense/attack-flow"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "name": "MITRE Center for Threat-Informed Defense",
+      "identity_class": "organization"
+    },
+    {
+      "type": "attack-flow",
+      "id": "attack-flow--63e420c7-562f-4a0a-ac7d-7e59f6b904c3",
+      "spec_version": "2.1",
+      "created": "2025-02-04T14:50:20.511Z",
+      "modified": "2025-03-31T13:09:11.853Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "created_by_ref": "identity--98a5dd1b-9f86-4599-aa25-9ef0b78f3791",
+      "start_refs": [
+        "attack-action--257ffdd4-bb50-425b-9091-f82fc184eccc",
+        "attack-action--7083e4bb-73a9-4982-b891-e65a17fd4cb3",
+        "attack-action--c7f20500-3dab-4ffc-b3cb-545a1b901925",
+        "attack-action--582fdf4c-da5a-45f9-ae83-b9dad0d8ccc5",
+        "attack-action--0eea63f2-14c5-404e-840d-1bcf082fe164",
+        "attack-condition--ed9ce25e-3124-46c3-9800-bf118b65c99c"
+      ],
+      "name": "Latrodectus",
+      "scope": "malware",
+      "external_references": [
+        {
+          "source_name": "Latrodectus, are you coming back? | Bitsight",
+          "url": "https://www.bitsight.com/blog/latrodectus-are-you-coming-back"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--98a5dd1b-9f86-4599-aa25-9ef0b78f3791",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.853Z",
+      "modified": "2025-03-31T13:09:11.853Z",
+      "name": "Maddie Bright",
+      "identity_class": "individual",
+      "contact_information": "mbright@mitre.org"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--257ffdd4-bb50-425b-9091-f82fc184eccc",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.853Z",
+      "modified": "2025-03-31T13:09:11.853Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Process Environment Block BeingDebugged",
+      "tactic_id": "OB0001",
+      "technique_id": "B0001.035"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--7083e4bb-73a9-4982-b891-e65a17fd4cb3",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.853Z",
+      "modified": "2025-03-31T13:09:11.853Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Check Processes",
+      "tactic_id": "OB0001",
+      "technique_id": "B0009.004",
+      "description": "Assesses for > 75 running processes for Windows 10 and newer, > 50 for OS older than Windows 10"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--c7f20500-3dab-4ffc-b3cb-545a1b901925",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Modern Specs Check",
+      "tactic_id": "OB0001",
+      "technique_id": "B0009.013",
+      "description": "Checks for 64-bit host"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--582fdf4c-da5a-45f9-ae83-b9dad0d8ccc5",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Unique Hardware/Firmware Check - MAC Address",
+      "tactic_id": "OB0001",
+      "technique_id": "B0009.028",
+      "description": "Ensures MAC addresses exist and are valid values"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--0eea63f2-14c5-404e-840d-1bcf082fe164",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Check Mutex",
+      "tactic_id": "OC0003",
+      "technique_id": "C0043",
+      "description": "Looks for mutex named 'running'",
+      "effect_refs": [
+        "attack-condition--4091668b-3f98-4b05-95a9-521ec3d6703a"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--e594ebea-5a98-4200-81ac-6a688e657831",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "System Information Discovery",
+      "tactic_id": "OB0007",
+      "technique_id": "E1082",
+      "description": "GetVolumeInformationW is used to determine the serial number for computing the bot ID",
+      "effect_refs": [
+        "attack-action--961e50bf-5799-43f2-9277-df5d72d27de3"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--218c1310-e244-493c-a8d5-76a71befb735",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "XOR",
+      "tactic_id": "OC0004",
+      "technique_id": "C0053.002",
+      "description": "Decodes XOR-encrypted file contents"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--25137e20-5ce8-42f5-ba2e-ff1cbc5c32c5",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Read File",
+      "tactic_id": "OC0001",
+      "technique_id": "C0051",
+      "description": "Fetches the C2 URLs",
+      "effect_refs": [
+        "attack-action--218c1310-e244-493c-a8d5-76a71befb735"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--6daf1e2b-0451-4233-9274-4e29c95e4204",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Authentication",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.011",
+      "description": "sends MAC addresses, hostname, and host domain"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f7a96d30-4e16-4955-94bc-64aa95732254",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "RC4",
+      "tactic_id": "OC0005",
+      "technique_id": "C0027.009",
+      "technique_ref": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+      "description": "Encypt the C2 beacon",
+      "effect_refs": [
+        "attack-action--02f64672-ba05-4090-b1ef-066a28e7f0a5"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--02f64672-ba05-4090-b1ef-066a28e7f0a5",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Base64",
+      "tactic_id": "OC0005",
+      "technique_id": "C0026.001",
+      "description": "Encode the C2 beacon",
+      "effect_refs": [
+        "attack-action--29c279a7-55af-4e93-9bc6-68923570ac0f"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--c7b64762-30d9-42af-90f3-994fd35ae504",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Directory Listing",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.012",
+      "description": "Collects file names from desktop"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f0d4d59a-1f6a-4d51-8c6a-268be304f864",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Send System Information",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.006",
+      "description": "Runs pre-set group of WIndows recon commands"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--8fafaa85-739d-4c15-9038-f9f0cf20c92e",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Process Discovery",
+      "tactic_id": "TA0007",
+      "tactic_ref": "x-mitre-tactic--c17c5845-175e-4421-9713-829d0573dbc9",
+      "technique_id": "T1057",
+      "technique_ref": "attack-pattern--8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+      "description": "collects PIDs and names of running processes"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--17382d39-8d97-457d-9a89-0f8d77dae0de",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Server to Client File Transfer",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.003",
+      "description": "Downloads DLL or EXE files"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--9bbbe9ff-b82f-40d9-840d-c6ad2439b7e6",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Execute File",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.013",
+      "description": "Uses rundll32 or cmd.exe to execute transferred files"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f5c36be6-4afc-45bb-b98e-76f4f6a1e09b",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Ingress Tool Transfer",
+      "tactic_id": "OB0004",
+      "technique_id": "E1105",
+      "description": "Downloads a stealer module"
+    },
+    {
+      "type": "grouping",
+      "id": "grouping--1d85143a-059a-438c-a794-10012880f3e8",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "name": "Sandbox/VM Checks",
+      "context": "Malware checks to ensure it is not executing within an analysis environment",
+      "object_refs": [
+        "attack-condition--ed9ce25e-3124-46c3-9800-bf118b65c99c",
+        "attack-action--582fdf4c-da5a-45f9-ae83-b9dad0d8ccc5",
+        "attack-action--257ffdd4-bb50-425b-9091-f82fc184eccc",
+        "attack-action--7083e4bb-73a9-4982-b891-e65a17fd4cb3",
+        "attack-action--0eea63f2-14c5-404e-840d-1bcf082fe164",
+        "attack-action--c7f20500-3dab-4ffc-b3cb-545a1b901925"
+      ]
+    },
+    {
+      "type": "attack-condition",
+      "id": "attack-condition--ed9ce25e-3124-46c3-9800-bf118b65c99c",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "description": "Discovers Indication of Execution in Sandbox?",
+      "on_false_refs": [
+        "attack-action--e594ebea-5a98-4200-81ac-6a688e657831"
+      ],
+      "on_true_refs": [
+        "attack-action--f2cc7510-ee8e-46b2-b110-56e51506d094"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--961e50bf-5799-43f2-9277-df5d72d27de3",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Non-cryptographic Hash: FNV Hash",
+      "tactic_id": "OC0004",
+      "technique_id": "C0030.005",
+      "description": "Used to calculate group ID",
+      "effect_refs": [
+        "attack-action--2e8bc208-cd80-44ed-ad8f-cf71d00749d3"
+      ]
+    },
+    {
+      "type": "attack-condition",
+      "id": "attack-condition--0f72ef7c-2379-44d9-9927-424fcfb6968c",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "description": "C2 File Exists?",
+      "on_true_refs": [
+        "attack-action--25137e20-5ce8-42f5-ba2e-ff1cbc5c32c5"
+      ],
+      "on_false_refs": [
+        "attack-action--6daf1e2b-0451-4233-9274-4e29c95e4204"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--2e8bc208-cd80-44ed-ad8f-cf71d00749d3",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Self-Discovery",
+      "tactic_id": "OB0007",
+      "technique_id": "B0038",
+      "description": "Check exe running from %appdata%",
+      "effect_refs": [
+        "attack-condition--c8cbe298-71ee-4ae3-92eb-dbd4e2e66a4f"
+      ]
+    },
+    {
+      "type": "attack-condition",
+      "id": "attack-condition--c8cbe298-71ee-4ae3-92eb-dbd4e2e66a4f",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "description": "Executing from AppData?",
+      "on_false_refs": [
+        "attack-action--3444fb5b-da4d-462f-88ce-3f7453e37f47"
+      ],
+      "on_true_refs": [
+        "attack-action--d0667ee0-ef70-49e0-a96a-b6777bda94ce"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--3444fb5b-da4d-462f-88ce-3f7453e37f47",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Copy FIle",
+      "tactic_id": "OC0001",
+      "technique_id": "C0045",
+      "description": "Copies executable to %appdata%",
+      "effect_refs": [
+        "attack-action--f2cfaa6c-5204-4708-8864-8f1d277c3170"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--73fd998a-ea52-4cdb-a957-e08cbefef97d",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Delete FIle",
+      "tactic_id": "OC0001",
+      "technique_id": "C0047",
+      "description": "Deletes old executable after executing in appdata"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--d0667ee0-ef70-49e0-a96a-b6777bda94ce",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Scheduled Task",
+      "tactic_id": "TA0003",
+      "tactic_ref": "x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92",
+      "technique_id": "T1053.005",
+      "technique_ref": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+      "description": "Creates task which runs at every logon",
+      "effect_refs": [
+        "attack-condition--0f72ef7c-2379-44d9-9927-424fcfb6968c"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--bc4c9f48-8244-494a-9241-7b062bd4620d",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Receive Data",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.002",
+      "description": "Receives commands from C2"
+    },
+    {
+      "type": "grouping",
+      "id": "grouping--56d45603-8674-4651-8e68-b9aa9ffa8737",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "name": "C2 Commands",
+      "context": "Commands malware receives from C2 and sends data in response",
+      "object_refs": [
+        "attack-action--c7b64762-30d9-42af-90f3-994fd35ae504",
+        "attack-action--f0d4d59a-1f6a-4d51-8c6a-268be304f864",
+        "attack-action--9bbbe9ff-b82f-40d9-840d-c6ad2439b7e6",
+        "attack-action--f5c36be6-4afc-45bb-b98e-76f4f6a1e09b",
+        "attack-action--17382d39-8d97-457d-9a89-0f8d77dae0de",
+        "attack-action--aa621f2f-6695-4280-a648-12b7399d740b",
+        "attack-action--8fafaa85-739d-4c15-9038-f9f0cf20c92e"
+      ]
+    },
+    {
+      "type": "attack-condition",
+      "id": "attack-condition--4091668b-3f98-4b05-95a9-521ec3d6703a",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "description": "Does the mutex already exist?",
+      "on_true_refs": [
+        "attack-action--ea43ca4b-a714-46fa-a2a7-6c0dce01d9e6"
+      ],
+      "on_false_refs": [
+        "attack-action--f2cc7510-ee8e-46b2-b110-56e51506d094"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--ea43ca4b-a714-46fa-a2a7-6c0dce01d9e6",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Create Mutex",
+      "tactic_id": "OC0003",
+      "technique_id": "C0041",
+      "description": "Mutex ensures only one instance of malware is running"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--aa621f2f-6695-4280-a648-12b7399d740b",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Write File",
+      "tactic_id": "OC0001",
+      "technique_id": "C0052",
+      "description": "Updates C2 URL file"
+    },
+    {
+      "type": "grouping",
+      "id": "grouping--2b4339ab-0b45-4cea-935f-9eda3205ab0a",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "name": "C2 Communications Loop",
+      "context": "After a C2 connection is established, the bot waits to receive commands and sends data back to the C2.",
+      "object_refs": [
+        "attack-action--f7a96d30-4e16-4955-94bc-64aa95732254",
+        "grouping--56d45603-8674-4651-8e68-b9aa9ffa8737",
+        "attack-action--bc4c9f48-8244-494a-9241-7b062bd4620d"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--29c279a7-55af-4e93-9bc6-68923570ac0f",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Send Data",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.001",
+      "description": "Data collected by implant as per C2 commands is sent to C2 via HTTPS"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f2cc7510-ee8e-46b2-b110-56e51506d094",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Suicide Exit",
+      "tactic_id": "OB0009",
+      "technique_id": "B0025.001"
+    },
+    {
+      "type": "file",
+      "id": "file--4d78d74a-eaf4-477d-ad24-fdbba67fa4cd",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "name": "Executable"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f2cfaa6c-5204-4708-8864-8f1d277c3170",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Command and Scripting Interpreter",
+      "technique_id": "T1059",
+      "technique_ref": "attack-pattern--7385dfaf-6886-4229-9ecd-6fd678040830",
+      "effect_refs": [
+        "attack-action--d0667ee0-ef70-49e0-a96a-b6777bda94ce",
+        "attack-action--73fd998a-ea52-4cdb-a957-e08cbefef97d"
+      ]
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--6780f44b-8e45-4f5e-a711-4075fe133e2d",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--218c1310-e244-493c-a8d5-76a71befb735",
+      "target_ref": "grouping--2b4339ab-0b45-4cea-935f-9eda3205ab0a"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--c4f5f848-38e3-49df-84c4-19ee77a12f14",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--6daf1e2b-0451-4233-9274-4e29c95e4204",
+      "target_ref": "grouping--2b4339ab-0b45-4cea-935f-9eda3205ab0a"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--5558d034-8b62-420b-9b76-9de3fe217b4f",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--3444fb5b-da4d-462f-88ce-3f7453e37f47",
+      "target_ref": "file--4d78d74a-eaf4-477d-ad24-fdbba67fa4cd"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--22778212-ea2d-41bb-b207-248a2fd9e048",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--4d78d74a-eaf4-477d-ad24-fdbba67fa4cd",
+      "target_ref": "attack-action--73fd998a-ea52-4cdb-a957-e08cbefef97d"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--34d11c40-be04-48ca-9799-c1f134037a24",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--4d78d74a-eaf4-477d-ad24-fdbba67fa4cd",
+      "target_ref": "attack-action--f2cfaa6c-5204-4708-8864-8f1d277c3170"
+    }
+  ]
+}