add December Newsletter (#171)

* Create 09192024.md

newsletter for MBC v3.2

* Update 09192024.md

* Update README.md

* Update 09192024.md

* Update 09192024.md

* Update 09192024.md

* Rename 09192024.md to 09242024.md

* Rename 09242024.md to 09232024.md

* Update README.md

* Update 09232024.md

* Update and rename 09232024.md to 10212024.md

* Update and rename 10212024.md to 12092024.md

* Update README.md

README.md

@@ -130,7 +130,7 @@ The table below lists MBC behaviors and related ATT&CK techniques. In most cases
 |**B0031**|COMMAND AND CONTROL|**Domain Name Generation**|Dynamic Resolution: Domain Name Generation ([T1568.002](https://attack.mitre.org/techniques/T1568/002))|
 |**B0032**|ANTI-STATIC ANALYSIS|**Executable Code Obfuscation**|*none*|
 |**B0033**|IMPACT|**Denial of Service**|Network Denial of Service ([T1498](https://attack.mitre.org/techniques/T1498))|
-|**B0034**|ANTI-STATIC ANALYSIS|**Executable Code Obfuscation**|*none*|
+|**B0034**|ANTI-STATIC ANALYSIS|**Executable Code Optimization**|*none*|
 |**B0035**|PERSISTENCE|**Shutdown Event**|*none*|
 |**B0036**|ANTI-BEHAVIORAL ANALYSIS|**Capture Evasion**|*none*|
 |**B0037**|DEFENSE EVASION|**Bypass Data Execution Prevention**|*none*|

anti-static-analysis/disassembler-evasion.md

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 February 2024</b></td>
+<td><b>22 August 2024</b></td>
 </tr>
 </table>
 
@@ -40,6 +40,7 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented
 |**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
 |**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; may be identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
 |**Desynchronizing Opaque Predicates**|B0012.006|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[6]](#6) This method is related to Unprotect technique U0201.|
+|**Fake Function**|B0012.007|A fake function call is used to call an address which confuses a disassembler and results in incorrect disassembly. Manually undefining the function call can enable the disassembler to produce the true code.|
 |**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[4]](#4) for an analysis of a VBA-Stomped malicious VBA Office document. See [[5]](#5) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
 |**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often in the same basic block or function.|
 

collection/archive-collected-data.md

@@ -37,11 +37,11 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org
 |Name|ID|Description|
 |---|---|---|
 |**Encoding**|E1560.m01|Data is encoded.|
-|**Encoding - Custom Encoding**|E1560.m04|Data is encoded. A custom algorithm is used to encode the exfiltrated data.|
-|**Encoding - Standard Encoding**|E1560.m03|Data is encoded. A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
+|**Encoding - Custom Algorithm**|E1560.m04|Data is encoded. A custom algorithm is used to encode the exfiltrated data.|
+|**Encoding - Standard Algorithm**|E1560.m03|Data is encoded. A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
 |**Encryption**|E1560.m02|Data is encrypted.|
-|**Encryption - Custom Encryption**|E1560.m06|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.|
-|**Encryption - Standard Encryption**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
+|**Encryption - Custom Algorithm**|E1560.m06|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.|
+|**Encryption - Standard Algorithm**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
 
 ## Use in Malware
 

defense-evasion/hijack-execution-flow.md

@@ -71,7 +71,7 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)|--|
-|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats|
+|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|CallWindowProc, EnumCalendarInfo, EnumCalendarInfoEx, EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumFontFamilies, EnumFontFamiliesEx, EnumFonts, EnumProps, EnumPropsEx, EnumResourceTypes, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats|
 |[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress|
 
 |Tool: CAPE|Mapping|APIs|

defense-evasion/modify-registry.md

@@ -79,7 +79,7 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
 |[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|Modify Registry (E1112)|--|
 |[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Modify Registry (E1112)|--|
 |[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Modify Registry (E1112)|--|
-|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
+|[neshta_regkeys](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
 |[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey|
 |[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Modify Registry (E1112)|--|
 |[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|

defense-evasion/obfuscated-files-or-information.md

@@ -47,11 +47,11 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |Name|ID|Description|
 |---|---|---|
 |**Encoding**|E1027.m01|A malware sample, file, or other information is encoded. This method is related to the subsequently defined ATT&CK sub-technique **Encrypted/Encoded File ([T1027.013](https://attack.mitre.org/techniques/T1027/013/))**.|
-|**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information. This method is related to Unprotect technique U0702.|
-|**Encoding-Standard Algorithm**|[E1027.m02](#e1027m02-snippet)|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information. This method is related to Unprotect technique U0701 and U0706.|
+|**Encoding - Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information. This method is related to Unprotect technique U0702.|
+|**Encoding - Standard Algorithm**|[E1027.m02](#e1027m02-snippet)|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information. This method is related to Unprotect technique U0701 and U0706.|
 |**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted. This method is related to Unprotect technique U0703 and to the subsequently defined ATT&CK sub-technique **Encrypted/Encoded File ([T1027.013](https://attack.mitre.org/techniques/T1027/013/))**.|
-|**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
-|**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information. This method is related to Unprotect technique U0701.|
+|**Encryption - Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
+|**Encryption - Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information. This method is related to Unprotect technique U0701.|
 |**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.|
 |**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|
 
@@ -106,6 +106,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
 |[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
 |[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptImportKey, CryptAcquireContext, CryptEncrypt|
+|[encrypt data using RC4 via SystemFunction033](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|SystemFunction033|
 |[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
 |[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
 |[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|

defense-evasion/process-injection.md

@@ -100,7 +100,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
 |[transacted_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|NtRollbackTransaction, NtMapViewOfSection, RtlSetCurrentTransaction|
 |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--|
 |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--|
-|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_silent_process_exit.py)|Process Injection (E1055)|--|
+|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--|
 |[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
 |[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_shim.py)|Process Injection::Injection using Shims (E1055.m03)|--|
 |[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_runpe.py)|Process Injection (E1055)|--|

defense-evasion/self-deletion.md

@@ -54,6 +54,7 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)|--|
+|[self delete using alternate data streams](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)|Defense Evasion::Self Deletion (F0007)|SetFileInformationByHandle|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|
@@ -69,4 +70,4 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 
 <a name="3">[3]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
 
-<a name="4">[4]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
+<a name="4">[4]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile

discovery/system-information-discovery.md

@@ -69,7 +69,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
 |---|---|---|
 |[query environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/query-environment-variable.yml)|System Information Discovery (E1082)|kernel32.GetEnvironmentVariable, kernel32.GetEnvironmentStrings, kernel32.ExpandEnvironmentStrings, msvcr90.getenv, msvcrt.getenv, System.Environment::GetEnvironmentVariable, System.Environment::GetEnvironmentVariables, System.Environment::ExpandEnvironmentVariables|
 |[get disk information](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-information.yml)|System Information Discovery (E1082)|kernel32.GetDriveType, kernel32.GetLogicalDrives, kernel32.GetVolumeInformation, kernel32.GetVolumeNameForVolumeMountPoint, kernel32.GetVolumePathNamesForVolumeName, kernel32.GetLogicalDriveStrings, kernel32.QueryDosDevice|
-|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx, DeviceIoControl|
+|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx|
 |[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)|--|
 |[get hostname](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/hostname/get-hostname.yml)|System Information Discovery (E1082)|kernel32.GetComputerName, kernel32.GetComputerNameEx, GetComputerObjectName, ws2_32.gethostname, gethostname|
 

execution/exploitation-for-client-execution.md

@@ -67,8 +67,8 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or
 |[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory|
 |[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateFile|
 |[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW|
-|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
-|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
+|[uses_windows_utilities](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
+|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
 |[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
 |[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll|
 |[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2015_2419.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|

impact/disk-wipe.md

@@ -46,6 +46,7 @@ This description refines the ATT&CK **Disk Wipe: Disk Content Wipe ([T1561.001](
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[overwrite Master Boot Record (MBR)](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml)|Disk Wipe (F0014)|kernel32.WriteFile|
+|[delete drive layout via IOCTL](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/delete-drive-layout-via-ioctl.yml)|Disk Wipe (F0014)|--|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|

mbc_summary.md

@@ -139,7 +139,6 @@
 |C0001|**[Socket Communication](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/socket-communication.md)**|COMMUNICATION|
 |C0009|**[Stack Pivot](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/memory/stack-pivot.md)**|MEMORY|
 |C0055|**[Suspend Thread](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/suspend-thread.md)**|PROCESS|
-|C0022|**[Synchronization](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/synchronization.md)**|PROCESS|
 |C0018|**[Terminate Process](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/terminate-process.md)**|PROCESS|
 |C0039|**[Terminate Thread](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/terminate-thread.md)**|PROCESS|
 |C0070|**[Unmap Section View](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/unmap-section-view.md)**|PROCESS|

micro-behaviors/communication/dns-communication.md

@@ -52,18 +52,18 @@ The DNS Communication micro-behavior focuses on DNS communication.
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[reference DNS over HTTPS endpoints](https://github.com/mandiant/capa-rules/blob/master/communication/dns/reference-dns-over-https-endpoints.yml)|DNS Communication::Server Connect (C0011.002)|--|
-|[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, getaddrinfo, GetAddrInfo, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses|
+|[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, GetAddrInfo, GetAddrInfoW, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[network_dns_blockchain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_blockchain.py)|DNS Communication (C0011)|--|
-|[network_dns_idn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_idn.py)|DNS Communication (C0011)|DnsQueryA|
-|[network_dns_opennic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_opennic.py)|DNS Communication (C0011)|--|
-|[network_dns_reverse_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_reverse_proxy.py)|DNS Communication (C0011)|--|
-|[network_dns_suspicious_querytype](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_suspicious_querytype.py)|DNS Communication (C0011)|DnsQueryA|
-|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_tunneling_request.py)|DNS Communication (C0011)|DnsQuery_A, DnsQuery_W|
-|[network_dns_doh_tls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_doh_tls.py)|DNS Communication (C0011)|--|
-|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|DNS Communication (C0011)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[network_dns_blockchain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSBlockChain|DNS Communication (C0011)|--|
+|[network_dns_idn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSIDN|DNS Communication (C0011)|DnsQueryA|
+|[network_dns_opennic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSOpenNIC|DNS Communication (C0011)|--|
+|[network_dns_reverse_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSReverseProxy|DNS Communication (C0011)|--|
+|[network_dns_suspicious_querytype](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSSuspiciousQueryType|DNS Communication (C0011)|DnsQueryA|
+|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDNSTunnelingRequest|DNS Communication (C0011)|DnsQuery_A, DnsQuery_W|
+|[network_dns_doh_tls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|NetworkDOHTLS|DNS Communication (C0011)|--|
+|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_dga.py)|NetworkDGA|DNS Communication (C0011)| --|
 
 ### C0011.001 Snippet
 <details>

micro-behaviors/communication/http-communication.md

@@ -94,31 +94,30 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |[connect to HTTP server](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-http-server.yml)|HTTP Communication::Connect to Server (C0002.009)|wininet.InternetConnect|
 |[extract HTTP body](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/extract-http-body.yml)|HTTP Communication::Extract Body (C0002.011)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|HTTP Communication (C0002)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
-|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|HTTP Communication (C0002)|--|
-|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|HTTP Communication::Send Request (C0002.003)|--|
-|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|HTTP Communication (C0002)|--|
-|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|HTTP Communication::Send Data (C0002.005)|--|
-|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_cnc_http.py)|HTTP Communication (C0002)|--|
-|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|HTTP Communication (C0002)|HttpOpenRequestA, HttpSendRequestA|
-|[network_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_http.py)|HTTP Communication (C0002)|--|
-|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/explorer_http.py)|HTTP Communication (C0002)|WinHttpConnect, WinHttpOpenRequest|
-|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|HTTP Communication (C0002)|--|
-|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|HTTP Communication::Send Data (C0002.005)|--|
-|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|HTTP Communication (C0002)|--|
-|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|HTTP Communication::Send Data (C0002.005)|--|
-|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_athenahttp.py)|HTTP Communication (C0002)|--|
-|[koadic_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/koadic_network_activity.py)|HTTP Communication (C0002)|HttpOpenRequestW, WinHttpOpenRequest|
-|[http_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/http_request.py)|HTTP Communication (C0002)|HttpOpenRequestA, HttpOpenRequestW, InternetConnectW, InternetOpenUrlA, InternetConnectA, InternetOpenUrlW, WinHttpGetProxyForUrl|
-|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_http_link.py)|HTTP Communication (C0002)|--|
-|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_reversed_http_link.py)|HTTP Communication (C0002)|--|
-|[https_urls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/https_urls.py)|HTTP Communication (C0002)|InternetOpenUrlW, InternetOpenUrlA|
-|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_http.py)|HTTP Communication (C0002)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile|
-|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_url.py)|HTTP Communication (C0002)|--|
-|[downloads_from_filehosting](https://github.com/CAPESandbox/community/tree/master/modules/signatures/downloads_from_filehosting.py)|HTTP Communication (C0002)|WinHttpOpenRequest, InternetOpenUrlA|
-|[purplewave_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_network_activity.py)|HTTP Communication (C0002)|InternetOpenW, HttpOpenRequestW, HttpSendRequestW, HttpAddRequestHeadersA|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/internet_dropper.py)|Internet_Dropper|HTTP Communication (C0002)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
+|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_madness.py)|Madness|HTTP Communication (C0002)|--|
+|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_madness.py)|Madness|HTTP Communication::Send Request (C0002.003)|--|
+|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive.py)|Drive|HTTP Communication (C0002)|--|
+|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive.py)|Drive|HTTP Communication::Send Data (C0002.005)|--|
+|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_cnc_http.py)|NetworkCnCHTTP|HTTP Communication (C0002)|--|
+|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_beacon.py)|Recon_Beacon|HTTP Communication (C0002)|HttpOpenRequestA, HttpSendRequestA|
+|[network_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_http.py)|NetworkHTTP|HTTP Communication (C0002)|--|
+|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_explorer.py)|ExplorerHTTP|HTTP Communication (C0002)|WinHttpConnect, WinHttpOpenRequest|
+|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive2.py)|Drive2|HTTP Communication (C0002)|--|
+|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive2.py)|Drive2|HTTP Communication::Send Data (C0002.005)|--|
+|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_dirtjumper.py)|DirtJumper|HTTP Communication (C0002)|--|
+|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_dirtjumper.py)|DirtJumper|HTTP Communication::Send Data (C0002.005)|--|
+|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_athenahttp.py)|AthenaHttp|HTTP Communication (C0002)|--|
+|[koadic_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/exploitation_framework_koadic.py)|KoadicNetworkActivity|HTTP Communication (C0002)|WinHttpOpenRequest, HttpOpenRequestW|
+|[http_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/http_request.py)|HTTP_Request|HTTP Communication (C0002)|HttpOpenRequestA, HttpOpenRequestW, InternetConnectW, InternetOpenUrlA, InternetConnectA, InternetOpenUrlW, WinHttpGetProxyForUrl|
+|[cmdline_http_link](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/cmdline_anomaly.py)|CommandLineHTTPLink|HTTP Communication (C0002)|--|
+|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/cmdline_anomaly.py)|CommandLineReversedHTTPLink|HTTP Communication (C0002)|--|
+|[network_docfile_http](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/network_docfile_http.py)|NetworkDocumentHTTP|HTTP Communication (C0002)|InternetCrackUrlW, InternetCrackUrlA, URLDownloadToFileW, HttpOpenRequestW, InternetReadFile, WSASend|
+|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/banker_zeus_url.py)|ZeusURL|HTTP Communication (C0002)|--|
+|[downloads_from_filehosting](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/filehostings.py)|Modiloader_APIs|HTTP Communication (C0002)|InternetOpenUrlA, WinHttpOpenRequest|
+|[purplewave_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_purplewave.py)|PurpleWaveNetworkAcivity|HTTP Communication (C0002)|InternetOpenW, HttpAddRequestHeadersA, HttpSendRequestW, HttpOpenRequestW|
 
 ### C0002.017 Snippet
 <details>

micro-behaviors/communication/icmp-communication.md

@@ -43,7 +43,7 @@ This micro-behavior is related to ICMP communication.
 |---|---|---|
 |[send ICMP echo request](https://github.com/mandiant/capa-rules/blob/master/communication/icmp/send-icmp-echo-request.yml)|ICMP Communication::Echo Request (C0014.002)|IcmpSendEcho, IcmpSendEcho2, IcmpSendEcho2Ex, Icmp6SendEcho2, IcmpCreateFile, Icmp6CreateFile, IcmpCloseHandle|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[suspicious_ping_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_ping_use.py)|ICMP Communication (C0014)|--|
-|[network_icmp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_icmp.py)|ICMP Communication (C0014)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[network_icmp](https://github.com/CAPESandbox/community/blob/master/modules/signatures/all/network_icmp.py)|NetworkICMP|ICMP Communication (C0014)|--|
+|[suspicious_ping_use](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|SuspiciousPingUse|ICMP Communication (C0014)|--|

micro-behaviors/communication/interprocess-communication.md

@@ -59,10 +59,10 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
 |[connect pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/connect/connect-pipe.yml)|Interprocess Communication::Connect Pipe (C0003.002)|kernel32.ConnectNamedPipe, kernel32.CallNamedPipe, System.IO.Pipes.NamedPipeClientStream::Connect, System.IO.Pipes.NamedPipeClientStream::ConnectAsync|
 |[read pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/read/read-pipe.yml)|Interprocess Communication::Read Pipe (C0003.003)|kernel32.PeekNamedPipe, kernel32.ReadFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication (C0003)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
-|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ipc_namedpipe.py)|IPC_NamedPipe|Interprocess Communication (C0003)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
+|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ipc_namedpipe.py)|IPC_NamedPipe|Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
 
 ### C0003.002 Snippet
 <details>

micro-behaviors/communication/smtp-communication.md

@@ -39,7 +39,7 @@ This micro-behavior focuses on SMTP communication.
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[network_smtp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_smtp.py)|SMTP Communication (C0012)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[network_smtp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_smtp.py)|NetworkSMTP|SMTP Communication (C0012)|--|
 

micro-behaviors/communication/socket-communication.md

@@ -69,26 +69,26 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |---|---|---|
 |[start TCP server](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/serve/start-tcp-server.yml)|Socket Communication::Start TCP Server (C0001.005)|listen, accept, WSAAccept, System.Net.Sockets.TcpListener::Start, System.Net.Sockets.TcpListener::AcceptTcpClient, System.Net.Sockets.TcpListener::BeginAcceptTcpClient, System.Net.Sockets.TcpListener::AcceptTcpClientAsync, System.Net.Sockets.TcpListener::AcceptSocket, System.Net.Sockets.TcpListener::BeginAcceptSocket, System.Net.Sockets.TcpListener::AcceptSocketAsync|
 |[act as TCP client](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/client/act-as-tcp-client.yml)|Socket Communication::TCP Client (C0001.008)|System.Net.Sockets.TcpClient::ctor|
-|[get socket status](https://github.com/mandiant/capa-rules/blob/master/communication/socket/get-socket-status.yml)|Socket Communication::Get Socket Status (C0001.012)|ws2_32.select|
-|[create raw socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-raw-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, ws2_32.WSASocketA|
-|[set socket configuration](https://github.com/mandiant/capa-rules/blob/master/communication/socket/set-socket-configuration.yml)|Socket Communication::Set Socket Config (C0001.001)|ws2_32.setsockopt, ws2_32.ioctlsocket|
+|[get socket status](https://github.com/mandiant/capa-rules/blob/master/communication/socket/get-socket-status.yml)|Socket Communication::Get Socket Status (C0001.012)|select, ws2_32.select|
+|[create raw socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-raw-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, ws32_32.WSASocket, WSASocketA, WSASocketW|
+|[set socket configuration](https://github.com/mandiant/capa-rules/blob/master/communication/socket/set-socket-configuration.yml)|Socket Communication::Set Socket Config (C0001.001)|ws2_32.setsockopt, ws2_32.ioctlsocket, setsockopt, ioctlsocket|
 |[create VMCI socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-vmci-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, DeviceIoControl, socket, ioctl|
-|[initialize Winsock library](https://github.com/mandiant/capa-rules/blob/master/communication/socket/initialize-winsock-library.yml)|Socket Communication::Initialize Winsock Library (C0001.009)|ws2_32.WSAStartup|
-|[connect TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/connect-tcp-socket.yml)|Socket Communication::Connect Socket (C0001.004)|connect, ws2_32.connect, ws2_32.WSAConnect, ConnectEx, WSAIoctl, setsockopt, bind|
-|[create TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket.yml)|Socket Communication::Create TCP Socket (C0001.011)|ws2_32.socket, ws2_32.WSASocket, socket|
+|[initialize Winsock library](https://github.com/mandiant/capa-rules/blob/master/communication/socket/initialize-winsock-library.yml)|Socket Communication::Initialize Winsock Library (C0001.009)|ws2_32.WSAStartup, WSAStartup|
+|[connect TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/connect-tcp-socket.yml)|Socket Communication::Connect Socket (C0001.004)|connect, ws2_32.connect, ws2_32.WSAConnect, WSAConnect, ConnectEx, ws2_32.WSAIoctl, WSAIoctl, setsockopt, bind|
+|[create TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket.yml)|Socket Communication::Create TCP Socket (C0001.011)|ws2_32.socket, ws2_32.WSASocket, socket, WSASocketA, WSASocketW, System.Net.Sockets.Socket::ctor|
 |[create TCP socket via raw AFD driver](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml)|Socket Communication::Create TCP Socket (C0001.011)|kernel32.CreateEvent, NtCreateFile, NtDeviceIoControlFile, kernel32.WaitForSingleObject|
 |[obtain TransmitPackets callback function via WSAIoctl](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml)|Socket Communication::Send TCP Data (C0001.014)|WSAIoctl, WSAGetLastError|
 |[send TCP data via WFP API](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/send-tcp-data-via-wfp-api.yml)|Socket Communication::Send TCP Data (C0001.014)|fwpkclnt.FwpsStreamInjectAsync0|
-|[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor|
-|[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send|
-|[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom|
+|[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, WSASocketA, WSASocketW, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor|
+|[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, sendto, WSASend, WSASendTo, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send|
+|[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, WSARecv, WSARecvDisconnect, WSARecvFrom, recvmsg, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[network_excessive_udp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_excessive_udp.py)|Socket Communication (C0001)|--|
-|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_network_activity.py)|Socket Communication (C0001)|send|
-|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Socket Communication (C0001)|send|
-|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|Socket Communication (C0001)|listen, bind|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[network_excessive_udp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_excessive_udp.py)|NetworkExcessiveUDP|Socket Communication (C0001)|--|
+|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_bind.py)|NetworkBIND|Socket Communication (C0001)|listen, bind|
+|[blackrat_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_blackremote.py)|BlackRATNetworkActivity|Socket Communication (C0001)|send|
+|[obliquerat_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_oblique.py)|ObliquekRATNetworkActivity|Socket Communication (C0001)|send|
 
 ### C0001.009 Snippet
 <details>

micro-behaviors/communication/wininet.md

@@ -44,9 +44,12 @@ The methods below are those of most interest in malware analysis. Details can be
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|WinINet (C0005)|InternetOpenA, InternetOpenUrlA|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[nemty_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNetworkActivity|WinINet (C0005)|InternetOpenA, InternetOpenUrlA|
+|[nemty_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNetworkActivity|WinINet::InternetOpen (C0005.002)|InternetOpenA|
+|[nemty_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNetworkActivity|WinINet::InternetOpenURL (C0005.003)|InternetOpenUrlA|
+|[powershell_network_connection](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/powershell_command.py)|PowerShellNetworkConnection|WinINet (C0005)|InternetCrackUrlW, InternetCrackUrlA|
 
 ### C0005.001 Snippet
 <details>

micro-behaviors/cryptography/decrypt-data.md

@@ -54,7 +54,7 @@ Malware may decrypt data.
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
-|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt [[1]](#1)|
 
 ## Detection
 
@@ -63,9 +63,9 @@ Malware may decrypt data.
 |[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Decrypt Data (C0031)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey|
 |[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decrypt Data (C0031)|CryptDecrypt|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Decryption|Decrypt Data (C0031)|CryptDecrypt|
 
 ## Code Snippets
 

micro-behaviors/cryptography/encrypt-data.md

@@ -86,7 +86,7 @@ Malware may encrypt data.
 |[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Encrypt Data::Sosemanuk (C0027.008)|--|
 |[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Encrypt Data::Camellia (C0027.003)|--|
 |[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Encrypt Data (C0027)|--|
-|[encrypt data using DPAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml)|Encrypt Data (C0027)|CryptProtectMemory, CryptUnprotectMemory, crypt32.CryptProtectData, crypt32.CryptUnprotectData, System.Security.Cryptography.ProtectedData::Unprotect, System.Security.Cryptography.ProtectedData::Protect|
+|[encrypt data using DPAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml)|Encrypt Data (C0027)|CryptProtectMemory, CryptUnprotectMemory, crypt32.CryptProtectData, crypt32.CryptUnprotectData, System.Security.Cryptography.ProtectedData::Unprotect, System.Security.Cryptography.ProtectedData::Protect, SystemFunction040, SystemFunction041|
 |[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Encrypt Data::3DES (C0027.004)|--|
 |[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Encrypt Data::3DES (C0027.004)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
 |[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Encrypt Data::RC4 (C0027.009)|--|
@@ -96,12 +96,18 @@ Malware may encrypt data.
 |[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Encrypt Data::Skipjack (C0027.013)|--|
 |[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Encrypt Data::Blowfish (C0027.002)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Encrypt Data (C0027)|CryptEncrypt|
-|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Encrypt Data (C0027)|CryptEncrypt|
-|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Encrypt Data (C0027)|CryptEncrypt, GetUserNameW, GetComputerNameW|
-|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Encrypt Data (C0027)|CryptEncrypt, GetUserNameW, GetComputerNameW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[mass_data_encryption](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_crypto.py)|MassDataEncryption|Encrypt Data (C0027)|CryptEncrypt|
+|[encrypt_data_agenttesla](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/malware_data_encryption.py)|EnryptDataAgentTeslaHTTP|Encrypt Data (C0027)|CryptEncrypt|
+|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/malware_data_encryption.py)|EnryptDataAgentTeslaHTTPT2|Encrypt Data (C0027)|CryptEncrypt, GetComputerNameW, GetUserNameW|
+|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/malware_data_encryption.py)|EnryptDataNanoCore|Encrypt Data (C0027)|CryptEncrypt, GetComputerNameW, GetUserNameW|
+|[dcrat_behavior](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_dcrat.py)|DCRatAPIs|Encrypt Data (C0027)|CryptHashData|
+|[rat_nanocore](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_nanocore.py)|NanocoreRAT|Encrypt Data (C0027)|CryptHashData|
+|[rat_luminosity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_luminosity.py)|LuminosityRAT|Encrypt Data (C0027)|CryptHashData|
+|[script_network_activity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/script_downloader.py)|ScriptNetworkActvity|Encrypt Data (C0027)|SslEncryptPacket|
+|[ransomware_file_modifications](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_filemodifications.py)|RansomwareFileModifications|Encrypt Data (C0027)|--|
+|[blackrat_apis](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_blackremote.py)|BlackRATAPIs|Encrypt Data (C0027)|CryptHashData|
 
 ## Code Snippets
 

micro-behaviors/cryptography/encryption-key.md

@@ -55,10 +55,10 @@ Malware may import, generate, or otherwise use an encryption key.
 |[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encryption Key::RC4 KSA (C0028.002)|--|
 |[reference public RSA key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rsa/reference-public-rsa-key.yml)|Encryption Key (C0028)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Encryption Key (C0028)|CryptEncrypt|
-|[generates_crypto_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/generates_crypto_key.py)|Encryption Key (C0028)|CryptGenKey, CryptExportKey|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[mass_data_encryption](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_crypto.py)|MassDataEncryption|Encryption Key (C0028)|CryptEncrypt|
+|[generates_crypto_key](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/crypto_apis.py)|CryptGenKey|Encryption Key (C0028)|CryptGenKey, CryptExportKey|
 
 ## References
 

micro-behaviors/cryptography/generate-pseudorandom-sequence.md

@@ -44,7 +44,7 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0021.003|BlackEnergy generates random numbers via WinAPI. [[1]](#1)|
-|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI [[1]](#1)|
 
 ## Detection
 

micro-behaviors/data/compression-library.md

@@ -35,7 +35,7 @@ Malware may utilize a compression library.
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|DarkComet linked against ZLIB. [[1]](#1)|
-|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Linked against ZLIB [[1]](#1)|
 
 ## Detection
 

micro-behaviors/data/decompress-data.md

@@ -54,9 +54,9 @@ Malware may decompress data.
 |[decompress data using QuickLZ](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-quicklz.yml)|Decompress Data::QuickLZ (C0025.001)|--|
 |[decompress data using UCL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-ucl.yml)|Decompress Data (C0025)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decompress Data (C0025)|RtlDecompressBuffer|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Compression|Decompress Data (C0025)|RtlDecompressBuffer|
 
 ## References
 

micro-behaviors/file-system/alter-file-extension.md

@@ -38,8 +38,8 @@ Malware alters a file extension. This could be done for many reasons, including
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_extensions.py)|Alter File Extension (C0015)|--|
-
-|[mimics_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mimics_extension.py)|Alter File Extension (C0015)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[mimics_extension](https://github.com/CAPESandbox/community/blob/master/modules/signatures/all/mimics_filename.py)|MimicsExtension|Alter File Extension (C0015)|--|
+|[ransomware_file_modifications](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_filemodifications.py)|RansomwareFileModifications|Alter File Extension (C0015)|MoveFileWithProgressW, MoveFileWithProgressTransactedW, NtCreateFile, NtWriteFile|
+|[ransomware_extensions](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_fileextensions.py)|RansomwareExtensions|Alter File Extension (C0015)|--|

micro-behaviors/file-system/copy-file.md

@@ -47,9 +47,9 @@ Malware copies a file.
 |---|---|---|
 |[copy file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/copy/copy-file.yml)|Copy File (C0045)|kernel32.CopyFile, kernel32.CopyFileEx, CopyFile2, CopyFileTransacted, LZCopy, System.IO.FileInfo::CopyTo, System.IO.File::Copy, kernel32.SHFileOperation|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[injection_needextension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_needextension.py)|Copy File (C0045)|NtCreateUserProcess, CreateProcessInternalW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[injection_needextension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_needextension.py)|InjectionExtension|Copy File (C0045)|NtCreateUserProcess, CreateProcessInternalW|
 
 ## References
 

micro-behaviors/file-system/create-directory.md

@@ -48,9 +48,9 @@ Malware creates a directory.
 |---|---|---|
 |[create directory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/create/create-directory.yml)|Create Directory (C0046)|kernel32.CreateDirectory, kernel32.CreateDirectoryEx, kernel32.CreateDirectoryTransacted, NtCreateDirectoryObject, ZwCreateDirectoryObject, SHCreateDirectory, SHCreateDirectoryEx, _mkdir, _wmkdir, System.IO.Directory::CreateDirectory, System.IO.DirectoryInfo::Create, System.IO.DirectoryInfo::CreateSubdirectory|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create Directory (C0046)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[arkei_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_arkei.py)|ArkeiFiles|Create Directory (C0046)|--|
 
 ### C0046 Snippet
 <details>

micro-behaviors/file-system/create-file.md

@@ -43,27 +43,31 @@ Malware creates a file.
 |---|---|---|
 |[create or open file](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-file.yml)|Create File (C0016)|CreateFile, CreateFileEx, IoCreateFile, IoCreateFileEx, ZwOpenFile, ZwCreateFile, NtOpenFile, NtCreateFile, LZCreateFile, LZOpenFile, fopen, fopen64, fdopen, freopen, open, openat|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Create File (C0016)|NtWriteFile|
-|[spreading_autoruninf](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spreading_autoruninf.py)|Create File (C0016)|--|
-|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create File (C0016)|--|
-|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_files.py)|Create File (C0016)|--|
-|[nemty_note](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_note.py)|Create File (C0016)|NtWriteFile|
-|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_files.py)|Create File (C0016)|--|
-|[masslogger_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_files.py)|Create File (C0016)|--|
-|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_message.py)|Create File (C0016)|NtWriteFile|
-|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_file_created.py)|Create File (C0016)|NtCreateFile|
-|[neshta_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_files.py)|Create File (C0016)|NtCreateFile|
-|[copies_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/copies_self.py)|Create File (C0016)|--|
-|[office_write_exe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_write_exe.py)|Create File (C0016)|NtWriteFile|
-|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_file.py)|Create File (C0016)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
-|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_files.py)|Create File (C0016)|--|
-|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Create File (C0016)|--|
-|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Create File::Create Ransomware File (C0016.002)|--|
-|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_files.py)|Create File (C0016)|--|
-|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_files.py)|Create File (C0016)|--|
-|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_embedded_office_file.py)|Create File (C0016)|--|
-|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_embedded_office_file.py)|Create File::Create Office Document (C0016.001)|--|
-|[qulab_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/qulab_files.py)|Create File (C0016)|--|
-|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_files.py)|Create File (C0016)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[copies_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/copies_self.py)|CopiesSelf|Create File (C0016)|--|
+|[rat_pcclient](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_pcclient.py)|PcClientMutexes|Create File (C0016)|--|
+|[ransomware_radamant](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_radamant.py)|RansomwareRadamant|Create File (C0016)|--|
+|[remcos_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/remcos.py)|RemcosFiles|Create File (C0016)|--|
+|[karagany_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_karagany.py)|KaraganyFiles|Create File (C0016)|--|
+|[obliquerat_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_oblique.py)|ObliquekRATFiles|Create File (C0016)|--|
+|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_message.py)|RansomwareMessage|Create File (C0016)|NtWriteFile|
+|[rat_luminosity](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_luminosity.py)|LuminosityRAT|Create File (C0016)|NtCreateFile, CryptHashData|
+|[xpertrat_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_xpert.py)|XpertRATFiles|Create File (C0016)|--|
+|[nemty_note](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_nemty.py)|NemtyNote|Create File (C0016)|NtWriteFile|
+|[office_write_exe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_write_exe.py)|OfficeWriteEXE|Create File (C0016)|NtWriteFile|
+|[warzonerat_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_warzone.py)|WarzoneRATFiles|Create File (C0016)|--|
+|[spreading_autoruninf](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/spreading_autoruninf.py)|CreatesAutorunInf|Create File (C0016)|--|
+|[neshta_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|NeshtaFiles|Create File (C0016)|NtCreateFile|
+|[arkei_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_arkei.py)|ArkeiFiles|Create File (C0016)|--|
+|[office_postscript](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/office_exploit.py)|OfficePostScript|Create File (C0016)|NtWriteFile|
+|[rat_nanocore](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_nanocore.py)|NanocoreRAT|Create File (C0016)|CryptHashData|
+|[qulab_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_qulab.py)|QulabFiles|Create File (C0016)|--|
+|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_files.py)|RansomwareFiles|Create File (C0016), Create File (C0016)|--|
+|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_files.py)|RansomwareFiles|Create File (C0016), Create File::Create Ransomware File (C0016.002)|--|
+|[dcrat_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_dcrat.py)|DCRatFiles|Create File (C0016)|--|
+|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/office_rtf.py)|RTFEmbeddedOfficeFile|Create File (C0016)|--|
+|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/office_rtf.py)|RTFEmbeddedOfficeFile|Create File::Create Office Document (C0016.001)|--|
+|[stack_pivot_file_created](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/stack_pivot.py)|StackPivotFileCreated|Create File (C0016)|NtCreateFile|
+|[masslogger_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerFiles|Create File (C0016)|--|
+|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_file.py)|StealthFile|Create File (C0016)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|

micro-behaviors/file-system/delete-directory.md

@@ -35,8 +35,8 @@ Malware deletes a directory.
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut deletes directories. [[1]](#1)|
-|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Delete directory [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Delete directory [[1]](#1)|
 
 ## Detection
 

micro-behaviors/file-system/delete-file.md

@@ -54,14 +54,17 @@ Malware deletes a file.
 |---|---|---|
 |[delete file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/delete/delete-file.yml)|Delete File (C0047)|kernel32.DeleteFile, DeleteFileTransacted, NtDeleteFile, ZwDeleteFile, remove, _wremove, System.IO.File::Delete, System.IO.FileSystemInfo::Delete, kernel32.SHFileOperation, MoveFileEx|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clears_logs.py)|Delete File (C0047)|--|
-|[removes_zoneid_ads](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_zoneid_ads.py)|Delete File (C0047)|DeleteFileW, DeleteFileA|
-|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_recyclebin.py)|Delete File (C0047)|--|
-|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_task_delete.py)|Delete File (C0047)|DeleteFileW|
-|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA|
-|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/clears_logs.py)|ClearsLogs|Delete File (C0047)|--|
+|[trickbot_task_delete](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/trickbot_files.py)|TrickBotTaskDelete|Delete File (C0047)|DeleteFileW|
+|[upatre_behavior](https://github.com/CAPESandbox/community/blob/master/modules/signatures/deprecated/upatre_apis.py)|Upatre_APIs|Delete File (C0047)|DeleteFileA|
+|[ransomware_file_modifications](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/ransomware_filemodifications.py)|RansomwareFileModifications|Delete File (C0047)|MoveFileWithProgressW, MoveFileWithProgressTransactedW, NtCreateFile, NtWriteFile|
+|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/anomalous_deletefile.py)|anomalous_deletefile|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA|
+|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_self.py)|DeletesSelf|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
+|[deletes_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/linux/deletes_files.py)|LinuxDeletesFile|Delete File (C0047)|--|
+|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_recyclebin.py)|RansomwareRecyclebin|Delete File (C0047)|--|
+|[removes_zoneid_ads](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_zoneid_ads.py)|RemovesZoneIdADS|Delete File (C0047)|DeleteFileW, DeleteFileA|
 
 ### C0047 Snippet
 <details>

micro-behaviors/file-system/move-file.md

@@ -47,9 +47,9 @@ Malware moves a file.
 |---|---|---|
 |[move file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/move/move-file.yml)|Move File (C0063)|kernel32.MoveFile, kernel32.MoveFileEx, MoveFileWithProgress, MoveFileTransacted, rename, _wrename, System.IO.FileInfo::MoveTo, System.IO.File::Move, kernel32.SHFileOperation|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[move_file_on_reboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/move_file_on_reboot.py)|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[move_file_on_reboot](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/move_file_on_reboot.py)|move_file_on_reboot|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW|
 
 ### C0063 Snippet
 <details>

micro-behaviors/file-system/read-file.md

@@ -58,14 +58,14 @@ Malware reads a file.
 |[read file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-file-on-linux.yml)|Read File (C0051)|fgetc, fgets, getc, getchar, read, getline, getdelim, fgetwc, getwc, fscanf, vfscanf, fread|
 |[read .ini file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-ini-file.yml)|Read File (C0051)|GetPrivateProfileInt, GetPrivateProfileString, GetPrivateProfileStruct, GetPrivateProfileSection, GetPrivateProfileSectionNames, GetFullPathName|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[reads_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/reads_self.py)|Read File (C0051)|NtReadFile, NtSetInformationFile, NtClose, NtCreateFile, NtOpenFile|
-|[accesses_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_sysvol.py)|Read File (C0051)|--|
-|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_devices.py)|Read File (C0051)|--|
-|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectfile.py)|Read File (C0051)|--|
-|[infostealer_browser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_browser.py)|Read File (C0051)|NtReadFile, CopyFileA, CopyFileExW, CopyFileW|
-|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Read File (C0051)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[reads_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/reads_self.py)|ReadsSelf|Read File (C0051)|NtReadFile, NtSetInformationFile, NtClose, NtCreateFile, NtOpenFile|
+|[accesses_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_sysvol.py)|AccessesSysvol|Read File (C0051)|--|
+|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_devices.py)|AntiDBGDevices|Read File (C0051)|--|
+|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectfile.py)|AntiAVDetectFile|Read File (C0051)|--|
+|[infostealer_browser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_browser.py)|BrowserStealer|Read File (C0051)|NtReadFile, CopyFileA, CopyFileExW, CopyFileW|
+|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectfile.py)|AntiAnalysisDetectFile|Read File (C0051)|--|
 
 ### C0051 Snippet
 <details>
@@ -84,5 +84,4 @@ call    qword ptr [->KERNEL32.DLL::ReadFile] ; API call to read file specified i
 
 ## References
 
-<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
-
+<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022

micro-behaviors/file-system/set-file-attributes.md

@@ -45,7 +45,7 @@ Malware sets file attributes.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[change file permission on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/change-file-permission-on-linux.yml)|Set File Attributes (C0050)|chown, fchown, lchown, fchownat|
+|[change file permission on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/change-file-permission-on-linux.yml)|Set File Attributes (C0050)|chown, fchown, lchown, fchownat, chmod, fchmod, fchmodat|
 |[set file attributes](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/set-file-attributes.yml)|Set File Attributes (C0050)|kernel32.SetFileAttributes, ZwSetInformationFile, NtSetInformationFile, System.IO.File::SetAttributes, System.IO.File::SetCreationTime, System.IO.File::SetCreationTimeUtc, System.IO.File::SetLastAccessTime, System.IO.File::SetLastAccessTimeUtc, System.IO.File::SetLastWriteTime, System.IO.File::SetLastWriteTimeUtc|
 
 ### C0050 Snippet

micro-behaviors/file-system/writes-file.md

@@ -51,21 +51,22 @@ Malware writes to a file.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[write file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-linux.yml)|Writes File (C0052)|fputc, fputs, putc, write, fputwc, putwc, fputws, write, fwrite, putwchar|
+|[write file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-linux.yml)|Writes File (C0052)|fputc, fputs, putc, write, fputwc, putwc, fputws, fwrite, putwchar, dprintf, vdprnitf, fprintf, vfprintf|
 |[write file on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-windows.yml)|Writes File (C0052)|kernel32.WriteFile, kernel32.WriteFileEx, NtWriteFile, ZwWriteFile, _fwrite, fwrite, System.IO.File::WriteAllBytes, System.IO.File::WriteAllBytesAsync, System.IO.File::WriteAllLines, System.IO.File::WriteAllLinesAsync, System.IO.File::WriteAllText, System.IO.File::WriteAllTextAsync, System.IO.File::AppendAllLines, System.IO.File::AppendAllLinesAsync, System.IO.File::AppendAllText, System.IO.File::AppendAllTextAsync, System.IO.File::AppendText, System.IO.FileInfo::AppendText|
 |[create process memory minidump](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/dump/create-process-memory-minidump.yml)|Writes File (C0052)|dbghelp.MiniDumpWriteDump|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/poullight_files.py)|Writes File (C0052)|--|
-|[masslogger_artifacts](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_artifacts.py)|Writes File (C0052)|CryptDecrypt, FindFirstFileExW|
-|[masslogger_version](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_version.py)|Writes File (C0052)|NtWriteFile|
-|[writes_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/writes_sysvol.py)|Writes File (C0052)|--|
-|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wiper_zeroedbytes.py)|Writes File (C0052)|NtWriteFile|
-|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_hostfile.py)|Writes File (C0052)|--|
-|[apocalypse_stealer_file_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/apocalypse_stealer_file_behavior.py)|Writes File (C0052)|--|
-|[echelon_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/echelon_files.py)|Writes File (C0052)|--|
-|[upatre_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/upatre_files.py)|Writes File (C0052)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[upatre_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/upatre_files.py)|UpatreFiles|Writes File (C0052)|--|
+|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/wiper.py)|WiperZeroedBytes|Writes File (C0052)|NtWriteFile|
+|[modify_hostsfile](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/modifies_hostsfile.py)|Modifies_HostFile|Writes File (C0052)|--|
+|[writes_sysvol](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/accesses_sysvol.py)|WritesSysvol|Writes File (C0052)|--|
+|[ursnif_behavior](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/trojan_ursnif.py)|UrsnifBehavior|Writes File (C0052)|--|
+|[poullight_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_poullight.py)|PoullightFiles|Writes File (C0052)|--|
+|[echelon_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_echelon.py)|EchelonFiles|Writes File (C0052)|--|
+|[apocalypse_stealer_file_behavior](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_apocalypse.py)|ApocalypseStealerFileBehavior|Writes File (C0052)|--|
+|[masslogger_version](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerVersion|Writes File (C0052)|NtWriteFile|
+|[masslogger_artifacts](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerArtifacts|Writes File (C0052)|FindFirstFileExW, CryptDecrypt|
 
 ### C0052 Snippet
 <details>

micro-behaviors/hardware/install-driver.md

@@ -40,5 +40,5 @@ Malware installs a driver or minifilter.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[install driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/install-driver.yml)|Install Driver (C0037)|ntdll.NtLoadDriver, ZwLoadDriver|
+|[install driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/install-driver.yml)|Install Driver (C0037)|ntdll.NtLoadDriver, ZwLoadDriver, NtSetSystemInformation ZwSetSystemInformation|
 |[register minifilter driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/filter/register-minifilter-driver.yml)|Install Driver::Minifilter (C0037.001)|FltRegisterFilter|

micro-behaviors/hardware/load-driver.md

@@ -42,6 +42,6 @@ Malware loads a device driver or minifilter.
 |---|---|---|
 |[start minifilter driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/filter/start-minifilter-driver.yml)|Load Driver::Minifilter (C0023.001)|FltStartFiltering|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_load.py)|Load Driver (C0023)|NtLoadDriver|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/driver_load.py)|DriverLoad|Load Driver (C0023)|NtLoadDriver|

micro-behaviors/memory/allocate-memory.md

@@ -48,14 +48,14 @@ Malware allocates memory, often to unpack itself.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)|--|
+|[allocate or change RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-or-change-rwx-memory.yml)|Allocate Memory (C0007)|--|
 |[allocate memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-memory.yml)|Allocate Memory (C0007)|kernel32.VirtualAlloc, kernel32.VirtualAllocEx, kernel32.VirtualAllocExNuma, kernel32.VirtualProtect, kernel32.VirtualProtectEx, NtAllocateVirtualMemory, ZwAllocateVirtualMemory, NtMapViewOfSection, ZwMapViewOfSection, NtProtectVirtualMemory, ZwProtectVirtualMemory|
-|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)|--|
+|[allocate or change RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-or-change-rw-memory.yml)|Allocate Memory (C0007)|--|
 |[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[Unpacker](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Unpacker|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
 
 ### C0007 Snippet
 <details>

micro-behaviors/memory/change-memory-protection.md

@@ -46,9 +46,9 @@ Malware may change memory protection. For example, read-write memory may be chan
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Change Memory Protection (C0008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|antidebug_guardpages|Change Memory Protection (C0008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
 
 ### C0008 Snippet
 <details>

micro-behaviors/memory/heap-spray.md

@@ -32,7 +32,7 @@ Malware may use heap spraying to write a sequence of bytes on the heap section o
 
 ## Detection
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_heapspray.py)|Heap Spray (C0006)|NtAllocateVirtualMemory|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_heapspray.py)|ExploitHeapspray|Heap Spray (C0006)|NtAllocateVirtualMemory|
 

micro-behaviors/operating-system/console.md

@@ -37,9 +37,9 @@ Malware modifies the console.
 |[set console window title](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/console/set-console-window-title.yml)|Console (C0033)|kernel32.SetConsoleTitle|
 |[manipulate console buffer](https://github.com/mandiant/capa-rules/blob/master/host-interaction/console/manipulate-console-buffer.yml)|Console (C0033)|kernel32.SetConsoleCursorPosition, kernel32.ReadConsoleOutputCharacter, kernel32.WriteConsoleOutputCharacter, kernel32.WriteConsoleOutput, kernel32.WriteConsoleInput, kernel32.GetStdHandle, System.Console::Write, System.Console::WriteLine|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Console (C0033)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bcdedit_command.py)|BCDEditCommand|Console (C0033)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
 
 ### C0033 Snippet
 <details>

micro-behaviors/operating-system/registry.md

@@ -97,128 +97,129 @@ Malware modifies the registry.
 |[create or open registry key](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-registry-key.yml)|Registry::Create Registry Key (C0036.004)|advapi32.RegOpenKey, advapi32.RegOpenKeyEx, advapi32.RegCreateKey, advapi32.RegCreateKeyEx, advapi32.RegOpenCurrentUser, advapi32.RegOpenKeyTransacted, advapi32.RegOpenUserClassesRoot, advapi32.RegCreateKeyTransacted, ZwOpenKey, ZwOpenKeyEx, ZwCreateKey, ZwOpenKeyTransacted, ZwOpenKeyTransactedEx, ZwCreateKeyTransacted, NtOpenKey, NtCreateKey, SHRegOpenUSKey, SHRegCreateUSKey, RtlCreateRegistryKey, Microsoft.Win32.RegistryKey::OpenSubKey, Microsoft.Win32.RegistryKey::OpenBaseKey, Microsoft.Win32.RegistryKey::OpenRemoteBaseKey, Microsoft.Win32.RegistryKey::CreateSubKey|
 |[create or open registry key](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-registry-key.yml)|Registry::Open Registry Key (C0036.003)|advapi32.RegOpenKey, advapi32.RegOpenKeyEx, advapi32.RegCreateKey, advapi32.RegCreateKeyEx, advapi32.RegOpenCurrentUser, advapi32.RegOpenKeyTransacted, advapi32.RegOpenUserClassesRoot, advapi32.RegCreateKeyTransacted, ZwOpenKey, ZwOpenKeyEx, ZwCreateKey, ZwOpenKeyTransacted, ZwOpenKeyTransactedEx, ZwCreateKeyTransacted, NtOpenKey, NtCreateKey, SHRegOpenUSKey, SHRegCreateUSKey, RtlCreateRegistryKey, Microsoft.Win32.RegistryKey::OpenSubKey, Microsoft.Win32.RegistryKey::OpenBaseKey, Microsoft.Win32.RegistryKey::OpenRemoteBaseKey, Microsoft.Win32.RegistryKey::CreateSubKey|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Registry (C0036)|--|
-|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Registry (C0036)|--|
-|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Registry::Set Registry Value (C0036.001)|--|
-|[modirat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modirat_behavior.py)|Registry (C0036)|--|
-|[darkcomet_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/darkcomet_regkeys.py)|Registry (C0036)|--|
-|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_revil_regkey.py)|Registry (C0036)|--|
-|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Registry (C0036)|--|
-|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Registry::Set Registry Value (C0036.001)|--|
-|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Registry (C0036)|--|
-|[mapped_drives_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mapped_drives_uac.py)|Registry (C0036)|--|
-|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_networking_icon.py)|Registry (C0036)|--|
-|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Registry (C0036)|--|
-|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_power_options.py)|Registry (C0036)|--|
-|[disables_cpl_disable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_cpl_disable.py)|Registry (C0036)|--|
-|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Registry (C0036)|--|
-|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Registry::Set Registry Value (C0036.001)|--|
-|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/hides_recycle_bin_icon.py)|Registry (C0036)|--|
-|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_restore_default_state.py)|Registry (C0036)|--|
-|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_auto_app_termination.py)|Registry (C0036)|--|
-|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_regkeys.py)|Registry (C0036)|--|
-|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Registry (C0036)|--|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Registry (C0036)|--|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Registry::Query Registry Key (C0036.005)|--|
-|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/prevents_safeboot.py)|Registry (C0036)|--|
-|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|Registry (C0036)|--|
-|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|Registry::Open Registry Key (C0036.003)|--|
-|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|Registry (C0036)|--|
-|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|Registry::Open Registry Key (C0036.003)|--|
-|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Registry (C0036)|--|
-|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_context_menus.py)|Registry (C0036)|--|
-|[ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ketrican_regkeys.py)|Registry (C0036)|--|
-|[ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ketrican_regkeys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Registry (C0036)|--|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Registry::Query Registry Key (C0036.005)|--|
-|[evil_grab](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Registry (C0036)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
-|[PlugX](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Registry (C0036)|memcpy, RtlDecompressBuffer|
-|[reg_binary](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Registry (C0036)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
-|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Registry (C0036)|--|
-|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_run_command.py)|Registry (C0036)|--|
-|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Registry (C0036)|--|
-|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Registry (C0036)|--|
-|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Registry (C0036)|--|
-|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[packer_armadillo_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_armadillo_regkey.py)|Registry (C0036)|--|
-|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_backups.py)|Registry (C0036)|--|
-|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Registry (C0036)|--|
-|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Registry::Open Registry Key (C0036.003)|--|
-|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_largekey.py)|Registry (C0036)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
-|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_username_startmenu.py)|Registry (C0036)|--|
-|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Registry (C0036)|--|
-|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_startmenu_search.py)|Registry (C0036)|--|
-|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Registry (C0036)|--|
-|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Registry (C0036)|--|
-|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Registry (C0036)|--|
-|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_regkeys.py)|Registry (C0036)|RegSetValueExA, RegSetValueExW|
-|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Registry (C0036)|NtCreateKey, NtSetValueKey|
-|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Registry (C0036)|--|
-|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Registry::Set Registry Value (C0036.001)|--|
-|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Registry (C0036)|--|
-|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Registry::Set Registry Value (C0036.001)|--|
-|[modify_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_certs.py)|Registry (C0036)|--|
-|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Registry (C0036)|--|
-|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Registry::Set Registry Value (C0036.001)|--|
-|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Registry (C0036)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
-|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
-|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_appv_virtualization.py)|Registry (C0036)|--|
-|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Registry (C0036)|--|
-|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Registry (C0036)|--|
-|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Registry (C0036)|--|
-|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Registry (C0036)|RegQueryValueExW, RegSetValueExW|
-|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Registry (C0036)|--|
-|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Registry::Query Registry Key (C0036.005)|--|
-|[dotnet_clr_usagelog_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dotnet_clr_usagelog_regkeys.py)|Registry (C0036)|--|
-|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rdptcp_key.py)|Registry (C0036)|--|
-|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Registry (C0036)|--|
-|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[disables_system_restore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_system_restore.py)|Registry (C0036)|--|
-|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_folder_options.py)|Registry (C0036)|--|
-|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Registry (C0036)|--|
-|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[removes_security_maintenance_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_security_maintenance_icon.py)|Registry (C0036)|--|
-|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Registry (C0036)|--|
-|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Registry (C0036)|--|
-|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Registry (C0036)|--|
-|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Registry::Query Registry Key (C0036.005)|--|
-|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Registry (C0036)|--|
-|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Registry::Set Registry Value (C0036.001)|--|
-|[enables_wdigest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enables_wdigest.py)|Registry (C0036)|--|
-|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_startmenu_defaults.py)|Registry (C0036)|--|
-|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_uac.py)|Registry (C0036)|--|
-|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Registry (C0036)|--|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Registry (C0036)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Registry::Query Registry Value (C0036.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_perfkey.py)|Registry (C0036)|--|
-|[modify_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_oem_information.py)|Registry (C0036)|--|
-|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Registry (C0036)|--|
-|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Registry (C0036)|--|
-|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Registry (C0036)|--|
-|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Registry (C0036)|--|
-|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Registry (C0036)|--|
-|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Registry (C0036)|--|
-|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Registry::Query Registry Key (C0036.005)|--|
-|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectreg.py)|Registry (C0036)|--|
-|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectreg.py)|Registry::Query Registry Key (C0036.005)|--|
-|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Registry (C0036)|--|
-|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Registry::Query Registry Key (C0036.005)|--|
-|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windowsupdate.py)|Registry (C0036)|--|
-|[recon_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_programs.py)|Registry (C0036)|RegQueryValueExA, RegQueryValueExW|
-|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Registry (C0036)|--|
-|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Registry::Set Registry Value (C0036.001)|--|
-|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_fingerprint.py)|Registry (C0036)|--|
-|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_pinned_programs.py)|Registry (C0036)|--|
-|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_regkeys.py)|Registry (C0036)|--|
-|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Registry (C0036)|--|
-|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Registry::Set Registry Value (C0036.001)|--|
-|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Registry (C0036)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesMailslot|Registry (C0036)|--|
+|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesMailslot|Registry::Open Registry Key (C0036.003)|--|
+|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesNetlogonRegkey|Registry (C0036)|--|
+|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|AccessesNetlogonRegkey|Registry::Open Registry Key (C0036.003)|--|
+|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|AntiAnalysisDetectReg|Registry (C0036)|--|
+|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|AntiAnalysisDetectReg|Registry::Open Registry Key (C0036.003)|--|
+|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry (C0036)|--|
+|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry::Query Registry Key (C0036.005)|--|
+|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|AntiAVSRP|Registry (C0036)|--|
+|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|AntiAVSRP|Registry::Set Registry Value (C0036.001)|--|
+|[antiemu_wine](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|WineDetectReg|Registry (C0036)|--|
+|[antiemu_wine](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|WineDetectReg|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|BochsDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry (C0036)|--|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|AntiVMCPU|Registry (C0036)| RegQueryValueExW, RegQueryValueExA, NtQueryValueKey|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|AntiVMCPU|Registry::Query Registry Key (C0036.005)| RegQueryValueExW, RegQueryValueExA, NtQueryValueKey|
+|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|AntiVMDiskReg|Registry (C0036)|--|
+|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|AntiVMDiskReg|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|AntiVMSCSI|Registry (C0036)| RegOpenKeyExA, RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW|
+|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|AntiVMSCSI|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry (C0036)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|AntiVMServices|Registry::Query Registry Value (C0036.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry (C0036)|--|
+|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|HyperVDetectKeys|Registry (C0036)|--|
+|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|HyperVDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|ParallelsDetectKeys|Registry (C0036)|--|
+|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|ParallelsDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|VBoxDetectKeys|Registry (C0036)|--|
+|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|VBoxDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|VMwareDetectKeys|Registry (C0036)|--|
+|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|VMwareDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|AntiVMDiskReg|Registry (C0036)|--|
+|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|VPCDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry (C0036)|--|
+|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry::Query Registry Key (C0036.005)|--|
+|[banker_geodo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Geodo|Registry (C0036)|--|
+|[banker_geodo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Geodo|Registry::Set Registry Value (C0036.001)|--|
+|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|BlackRATRegistryKeys|Registry (C0036)| RegSetValueExW, RegQueryValueExW|
+|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|BrowserAddon|Registry (C0036)|--|
+|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|BrowserAddon|Registry::Set Registry Value (C0036.001)|--|
+|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_bho.py)|BrowserHelperObject|Registry (C0036)|--|
+|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_bho.py)|BrowserHelperObject|Registry::Set Registry Value (C0036.001)|--|
+|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|BrowserSecurity|Registry (C0036)|--|
+|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|BrowserSecurity|Registry::Set Registry Value (C0036.001)|--|
+|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|browser_startpage|Registry (C0036)|--|
+|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|browser_startpage|Registry::Set Registry Value (C0036.001)|--|
+|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|BypassFirewall|Registry (C0036)|--|
+|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|BypassFirewall|Registry::Set Registry Value (C0036.001)|--|
+|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_largekey.py)|CreatesLargeKey|Registry (C0036)| NtSetValueKey, RegSetValueExA RegSetValueExW|
+|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|CreatesNullValue|Registry (C0036)| NtSetValueKey, NtCreateKey|
+|[darkcomet_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/darkcomet_regkeys.py)|DarkCometRegkeys|Registry (C0036)|--|
+|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|DisablesAppLaunch|Registry (C0036)|--|
+|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_appv_virtualization.py)|DisablesAppVirtualiztion|Registry (C0036)|--|
+|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app_autotermination.py)|DisablesAutomaticAppTermination|Registry (C0036)|--|
+|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_backups.py)|DisablesBackups|Registry (C0036)|--|
+|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_browserwarn.py)|DisablesBrowserWarn|Registry (C0036)|--|
+|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_context_menus.py)|DisablesContextMenus|Registry (C0036)|--|
+|[disables_cpl_display](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_cpl_display.py)|DisablesCPLDisplay|Registry (C0036)|--|
+|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_event_logging.py)|DisablesEventLogging|Registry (C0036)|--|
+|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_folder_options.py)|DisableFolderOptions|Registry (C0036)|--|
+|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_notificationcenter.py)|DisablesNotificationCenter|Registry (C0036)|--|
+|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_power_options.py)|DisablesPowerOptions|Registry (C0036)|--|
+|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_restore_default_state.py)|DisablesRestoreDefaultState|Registry (C0036)|--|
+|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_run_command.py)|DisableRunCommand|Registry (C0036)|--|
+|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_smartscreen.py)|DisablesSmartScreen|Registry (C0036)|--|
+|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|DisablesStartMenuSearch|Registry (C0036)|--|
+|[disables_sysrestore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_sysrestore.py)|DisablesSystemRestore|Registry (C0036)|--|
+|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_uac.py)|DisablesUAC|Registry (C0036)|--|
+|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wer.py)|DisablesWER|Registry (C0036)|--|
+|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|DisablesWindowsDefenderDISM|Registry (C0036)|--|
+|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|DisablesWindowsDefenderLogging|Registry (C0036)|--|
+|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windowsupdate.py)|DisablesWindowsUpdate|Registry (C0036)|--|
+|[dotnet_clr_usagelog_regkeys](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/modifies_dotnetclr_knobs.py)|DotNetCLRUsageLogKnow|Registry (C0036)|--|
+|[enables_wdigest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/credential_access.py)|EnablesWDigest|Registry (C0036)|--|
+|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/hides_recyclebin_icon.py)|HidesRecycleBinIcon|Registry (C0036)|--|
+|[ketrican_reg_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/backdoor_ketrican_regkeys.py)|KetricanRegkeys| Registry::Query Registry Key (C0036.005)|--|
+|[ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/backdoor_ketrican_regkeys.py)|KetricanRegkeys| Registry (C0036)|--|
+|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|LimeRATRegkeys|Registry (C0036)|--|
+|[mapped_drives_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/forces_mappeddrives_uac.py)|MappedDrivesUAC| Registry (C0036)|--|
+|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_medusalocker.py)|MedusaLockerRegkeys|Registry (C0036)|--|
+|[modifies_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_certs.py)|ModifiesCerts| Registry (C0036)|--|
+|[modifies_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_oem.py)|ModifiesOEMInformation|Registry (C0036)|--|
+|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|ModifiesAttachmentManager|Registry (C0036)|--|
+|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|ModifiesAttachmentManager|Registry::Set Registry Value (C0036.001)|--|
+|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_proxy.py)|ModifyProxy|Registry (C0036)|--|
+|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_proxy.py)|ModifyProxy|Registry::Set Registry Value (C0036.001)|--|
+|[modirat_behavior](https://https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/rat_modi.py)|ModiRATBehavior|Registry (C0036)|--|
+|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_nemty.py)|NemtyRegkeys|Registry (C0036)|--|
+|[neshta_regkeys](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|NeshtaRegKeys|Registry (C0036)| RegSetValueExA, RegSetValueExW|
+|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_njrat_regkeys.py)|NjratRegkeys|Registry (C0036)|--|
+|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|OfficePerfKey|Registry (C0036)|--|
+|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_security.py)|OfficeSecurity|Registry (C0036)|--|
+|[packer_armadillo_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/packer_armadillo_regkey.py)|ArmadilloRegKey| Registry (C0036)|--|
+|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|PersistenceIFEO|Registry (C0036)|--|
+|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_remotedesktop.py)|PersistenceRDPRegistry|Registry (C0036)|--|
+|[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_shim.py)|PersistenceShimDatabase|Registry (C0036)|--|
+|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|PersistenceSilentProcessExit|Registry (C0036)|--|
+|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/prevents_safeboot.py)|PreventsSafeboot|Registry (C0036)|--|
+|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_radamant.py)|RansomwareRadamant|Registry (C0036)|--|
+|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_revil_regkey.py)|RevilRegkey|Registry (C0036)|--|
+|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_spynet.py)|SpynetRat|Registry (C0036)|--|
+|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|RDPTCPKey|Registry (C0036)|--|
+|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_fingerprint.py)|Fingerprint|Registry (C0036)|--|
+|[recon_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_programs.py)|InstalledApps|Registry (C0036)|RegQueryValueExA, RegQueryValueExW|
+|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|RemcosRegkeys|Registry (C0036)|--|
+|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_networking_icon.py)|RemovesNetworkingIcon|Registry (C0036)|--|
+|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_pinned_programs.py)|RemovesPinnedPrograms|Registry (C0036)|--|
+|[removes_sec_maintain_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_sec_maintain_icon.py)|RemovesSecurityAndMaintenanceIcon|Registry (C0036)|--|
+|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_startmenu_defaults.py)|RemovesStartMenuDefaults|Registry (C0036)|--|
+|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_username_startmenu.py)|RemovesUsernameStartMenu|Registry (C0036)|--|
+|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|RemovesWindowsDefenderContextMenu|Registry (C0036)|--|
+|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|StealthHiddenExtension|Registry (C0036)|--|
+|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|StealthHiddenReg|Registry (C0036)|--|
+|[stealth_hidenotifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|StealthHideNotifications|Registry (C0036)|--|
+|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_etw.py)|TampersETW|Registry (C0036)|--|
+|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_powershell_logging.py)|TampersPowerShellLogging|Registry (C0036)|--|
+|[ursnif_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trojan_ursnif.py)|UrsnifBehavior|Registry (C0036)|--|
+|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_warzone.py)|WarzoneRATRegkeys|Registry (C0036)|--|![image](https://github.com/user-attachments/assets/1fd99cef-9381-4ab6-a06b-e822e934cfcb)
 
 ### C0036.005 Snippet
 <details>

micro-behaviors/operating-system/wallpaper.md

@@ -36,6 +36,6 @@ Malware modifies the wallpaper.
 |---|---|---|
 |[change the wallpaper](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/session/wallpaper/change-the-wallpaper.yml)|Wallpaper (C0035)|SystemParametersInfo|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[modify_desktop_wallpaper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_desktop_wallpaper.py)|Wallpaper (C0035)|SystemParametersInfoA, SystemParametersInfoW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[modify_desktop_wallpaper](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/modifies_wallpaper.py)|ModifiesDesktopWallpaper|Wallpaper (C0035)|SystemParametersInfoA, SystemParametersInfoW|

micro-behaviors/process/README.md

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>29 November 2022</b></td>
+<td><b>16 September 2024</b></td>
 </tr>
 </table>
 
@@ -29,8 +29,7 @@ Micro-behaviors related to processes.
 * **Set Thread Context** [C0072](../process/set-thread-context.md)
 * **Set Thread Local Storage Value** [C0041](../process/set-thread-local-storage-value.md)
 * **Suspend Thread** [C0055](../process/suspend-thread.md)	
-* **Synchronization** [C0022](../process/synchronization.md)
 * **Terminate Process** [C0018](../process/terminate-process.md)
 * **Terminate Thread** [C0039](../process/terminate-thread.md)
 * **Unmap Section View** [C0070](../process/unmap-section-view.md)
-* **Write Process Memory** [C0071](../process/write-process-memory.md)
+* **Write Process Memory** [C0071](../process/write-process-memory.md)

micro-behaviors/process/allocate-thread-local-storage.md

@@ -41,7 +41,7 @@ Malware allocates thread local storage.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc|
+|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/tls/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc|
 
 ### C0040 Snippet
 <details>

micro-behaviors/process/check-mutex.md

@@ -44,12 +44,13 @@ Malware checks a mutex.
 |[check mutex](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/check-mutex.yml)|Check Mutex (C0043)|kernel32.OpenMutex, System.Threading.Mutex::OpenExisting, System.Threading.Mutex::TryOpenExisting, kernel32.GetLastError|
 |[check mutex and exit](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/check-mutex-and-exit.yml)|Check Mutex (C0043)|ExitProcess, exit, _Exit, _exit, WaitForSingleObject, GetLastError|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_mutex.py)|Check Mutex (C0043)|--|
-|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_mutex.py)|Check Mutex (C0043)|--|
-|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_mutexes.py)|Check Mutex (C0043)|--|
-|[purplewave_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_mutexes.py)|Check Mutex (C0043)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_mutex.py)|VPCDetectMutex|Check Mutex (C0043)|--|
+|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_mutex.py)|AntisandboxSboxieMutex|Check Mutex (C0043)|--|
+|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_mutexes.py)|VMwareDetectMutexes|Check Mutex (C0043)|--|
+|[purplewave_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_purplewave.py)|PurpleWaveMutexes|Check Mutex (C0043)|--|
+|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_mutex.py)|AntisandboxSboxieMutex|Check Mutex (C0043)|--|
 
 ### C0043 Snippet
 <details>

micro-behaviors/process/create-mutex.md

@@ -21,14 +21,14 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>30 April 2024</b></td>
+<td><b>16 September 2024</b></td>
 </tr>
 </table>
 
 
 # Create Mutex
 
-Malware creates a mutex. 
+Malware creates a mutex. Mutexes may be created for synchronization purposes (two or more processes/threads to share a resource).
 
 ## Use in Malware
 
@@ -48,59 +48,68 @@ Malware creates a mutex.
 |[create mutex](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/create-mutex.yml)|Create Mutex (C0042)|kernel32.CreateMutex, kernel32.CreateMutexEx, System.Threading.Mutex::ctor|
 |[lock file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/lock-file.yml)|Create Mutex (C0042)|fcntl|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[banker_zeus_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_mutex.py)|Create Mutex (C0042)|--|
-|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/parallax_mutexes.py)|Create Mutex (C0042)|--|
-|[gandcrab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/gandcrab_mutexes.py)|Create Mutex (C0042)|--|
-|[packer_armadillo_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_armadillo_mutex.py)|Create Mutex (C0042)|--|
-|[fleercivet_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/fleercivet_mutex.py)|Create Mutex (C0042)|--|
-|[renamer_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/renamer_mutexes.py)|Create Mutex (C0042)|--|
-|[revil_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/revil_mutexes.py)|Create Mutex (C0042)|--|
-|[trickbot_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_mutex.py)|Create Mutex (C0042)|--|
-|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_fynloski_mutexes.py)|Create Mutex (C0042)|--|
-|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_beebus_mutexes.py)|Create Mutex (C0042)|--|
-|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_mutexes.py)|Create Mutex (C0042)|--|
-|[nemty_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_mutexes.py)|Create Mutex (C0042)|--|
-|[stop_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stop_ransom_mutexes.py)|Create Mutex (C0042)|--|
-|[okrum_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/okrum_mutexes.py)|Create Mutex (C0042)|--|
-|[pysa_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pysa_mutexes.py)|Create Mutex (C0042)|--|
-|[banker_cridex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_cridex.py)|Create Mutex (C0042)|--|
-|[fonix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/fonix_mutexes.py)|Create Mutex (C0042)|--|
-|[germanwiper_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/germanwiper_mutexes.py)|Create Mutex (C0042)|--|
-|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ratsnif_mutexes.py)|Create Mutex (C0042)|--|
-|[crat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/crat_mutexes.py)|Create Mutex (C0042)|--|
-|[neshta_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_mutexes.py)|Create Mutex (C0042)|--|
-|[banker_spyeye_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_spyeye_mutexes.py)|Create Mutex (C0042)|--|
-|[powerpool_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powerpool_mutexes.py)|Create Mutex (C0042)|--|
-|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Create Mutex (C0042)|--|
-|[deepfreeze_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deepfreeze_mutex.py)|Create Mutex (C0042)|--|
-|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_xtreme_mutexes.py)|Create Mutex (C0042)|--|
-|[lokibot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/lokibot_mutexes.py)|Create Mutex (C0042)|--|
-|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_mutexes.py)|Create Mutex (C0042)|--|
-|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_plugx_mutexes.py)|Create Mutex (C0042)|--|
-|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_mutexes.py)|Create Mutex (C0042)|--|
-|[cypherit_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cypherit_mutexes.py)|Create Mutex (C0042)|--|
-|[protonbot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/protonbot_mutexes.py)|Create Mutex (C0042)|--|
-|[cryptomix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomix_mutexes.py)|Create Mutex (C0042)|--|
-|[phorpiex_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/phorpiex_mutexes.py)|Create Mutex (C0042)|--|
-|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/venomrat_mutexes.py)|Create Mutex (C0042)|--|
-|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_mutexes.py)|Create Mutex (C0042)|--|
-|[andromut_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/andromut_mutexes.py)|Create Mutex (C0042)|--|
-|[azorult_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/azorult_mutexes.py)|Create Mutex (C0042)|--|
-|[dharma_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dharma_mutexes.py)|Create Mutex (C0042)|--|
-|[rat_quasar_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_quasar_mutexes.py)|Create Mutex (C0042)|--|
-|[bot_russkill](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_russkill.py)|Create Mutex (C0042)|--|
-|[snake_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/snake_ransom_mutexes.py)|Create Mutex (C0042)|--|
-|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_mutexes.py)|Create Mutex (C0042)|--|
-|[qulab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/qulab_mutexes.py)|Create Mutex (C0042)|--|
-|[allaple_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/allaple_mutexes.py)|Create Mutex (C0042)|--|
-|[banker_zeus_p2p](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_p2p.py)|Create Mutex (C0042)|--|
-|[carberp_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/carberp_mutex.py)|Create Mutex (C0042)|--|
-|[rat_poisonivy_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_poisonivy_mutexes.py)|Create Mutex (C0042)|--|
-|[satan_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/satan_mutexes.py)|Create Mutex (C0042)|--|
-|[medusalocker_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_mutexes.py)|Create Mutex (C0042)|--|
-|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_mutexes.py)|Create Mutex (C0042)|--|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[allaple_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/worm_allaple_mutex.py)|AllapleMutexes|Create Mutex (C0042)|--|
+|[andromut_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/downloader_andromut_mutex.py)|AndromutMutexes|Create Mutex (C0042)|--|
+|[asyncrat_mutex_raccoon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_raccoon.py)|RaccoonInfoStealerMutex|Create Mutex (C0042)|--|
+|[asyncrat_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/asyncrat_mutex.py)|AsyncRatMutex|Create Mutex (C0042)|--|
+|[azorult_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_azorult_mutex.py)|AzorultMutexes|Create Mutex (C0042)|--|
+|[banker_cridex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_cridex.py)|Cridex|Create Mutex (C0042)|--|
+|[banker_spyeye_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_spyeye_mutex.py)|SpyEyeMutexes|Create Mutex (C0042)|--|
+|[banker_zeus_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_zeus_mutex.py)|ZeusMutexes|Create Mutex (C0042)|--|
+|[banker_zeus_p2p](https://github.com/CAPESandbox/community/blob/master/modules/signatures/all/banker_zeus_p2p.py)|ZeusP2P|Create Mutex (C0042)|--|
+|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|BlackRATMutexes|Create Mutex (C0042)|--|
+|[bot_russkill](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bot_russkill.py)|Ruskill|Create Mutex (C0042)|--|
+|[carberp_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/carberp_mutex.py)|CarberpMutexes|Create Mutex (C0042)|--|
+|[crat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_crat.py)|CRATMutexes|Create Mutex (C0042)|--|
+|[cryptomix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_cryptomix.py)|CryptoMixMutexes|Create Mutex (C0042)|--|
+|[cypherit_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cypherit_mutex.py)|CypherITMutexes|Create Mutex (C0042)|--|
+|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_dcrat.py)|DCRatMutex|Create Mutex (C0042)|--|
+|[deepfreeze_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deepfreeze_mutex.py)|DeepFreezeMutex|Create Mutex (C0042)|--|
+|[dharma_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_dharma.py)|DharmaMutexes|Create Mutex (C0042)|--|
+|[fleercivet_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trojan_fleercivet_mutex.py)|FleerCivetMutexes|Create Mutex (C0042)|--|
+|[fonix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_fonix_mutex.py)|FonixMutexes|Create Mutex (C0042)|--|
+|[gandcrab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_gandcrab.py)|GandCrabMutexes|Create Mutex (C0042)|--|
+|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Geodo|Create Mutex (C0042)|--|
+|[germanwiper_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_germanwiper.py)|GermanWiperMutexes|Create Mutex (C0042)|--|
+|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|LimeRATMutexes|Create Mutex (C0042)|--|
+|[lokibot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trojan_lokibot_mutex.py)|LokibotMutexes|Create Mutex (C0042)|--|
+|[medusalocker_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_medusalocker.py)|MedusaLockerMutexes|Create Mutex (C0042)|--|
+|[nemty_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_nemty.py)|NemtyMutexes|Create Mutex (C0042)|--|
+|[neshta_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/virus_neshta.py)|NeshtaMutexes|Create Mutex (C0042)|--|
+|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_oblique.py)|ObliquekRATMutexes|Create Mutex (C0042)|--|
+|[okrum_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/backdoor_okrum_mutex.py)|OkrumMutexes|Create Mutex (C0042)|--|
+|[packer_armadillo_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/packer_armadillo_mutex.py)|ArmadilloMutex|Create Mutex (C0042)|--|
+|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_parallax_mutex.py)|ParallaxMutexes|Create Mutex (C0042)|--|
+|[phorpiex_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/downloader_phorpiex_mutex.py)|PhorpiexMutexes|Create Mutex (C0042)|--|
+|[powerpool_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powerpool_mutex.py)|PowerpoolMutexes|Create Mutex (C0042)|--|
+|[protonbot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/downloader_protonbot_mutex.py)|ProtonBotMutexes|Create Mutex (C0042)|--|
+|[pysa_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_pysa_mutex.py)|PYSAMutexes|Create Mutex (C0042)|--|
+|[qulab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_qulab.py)|QulabMutexes|Create Mutex (C0042)|--|
+|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_radamant.py)|RansomwareRadamant|Create Mutex (C0042)|--|
+|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_beebus_mutex.py)|BeebusMutexes|Create Mutex (C0042)|--|
+|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_fynloski_mutex.py)|FynloskiMutexes|Create Mutex (C0042)|--|
+|[rat_luminosity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_luminosity.py)|LuminosityRAT|Create Mutex (C0042)| CryptHashData, NtCreateMutant|
+|[rat_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_nanocore.py)|NanocoreRAT|Create Mutex (C0042)|--|
+|[rat_pcclient](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_pcclient.py)|PcClientMutexes|Create Mutex (C0042)|--|
+|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_plugx_mutex.py)|PlugxMutexes|Create Mutex (C0042)|--|
+|[rat_poisonivy_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_poisonivy.py)|PoisonIvyMutexes|Create Mutex (C0042)|--|
+|[rat_quasar_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_quasar.py)|QuasarMutexes|Create Mutex (C0042)|--|
+|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_spynet.py)|SpynetRat|Create Mutex (C0042)|--|
+|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xtreme_mutex.py)|XtremeMutexes|Create Mutex (C0042)|--|
+|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_ratsnif_mutex.py)|RatsnifMutexes|Create Mutex (C0042)|--|
+|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|RemcosMutexes|Create Mutex (C0042)|--|
+|[renamer_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/virus_renamer_mutex.py)|RenamerMutexes|Create Mutex (C0042)|--|
+|[revil_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_revil_mutex.py)|RevilMutexes|Create Mutex (C0042)|--|
+|[satan_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_satan_mutex.py)|SatanMutexes|Create Mutex (C0042)|--|
+|[snake_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_snake_mutex.py)|SnakeRansomMutexes|Create Mutex (C0042)|--|
+|[stop_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_stop.py)|StopRansomMutexes|Create Mutex (C0042)|--|
+|[targeted_flame](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/targeted_flame.py)|Flame|Create Mutex (C0042)|--|
+|[trickbot_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trickbot_mutex.py)|TrickBotMutexes|Create Mutex (C0042)|--|
+|[ursnif_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trojan_ursnif.py)|UrsnifBehavior|Create Mutex (C0042)|--|
+|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_venom.py)|VenomRAT|Create Mutex (C0042)|--|
+|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xpert.py)|XpertRATMutexes|Create Mutex (C0042)|--|![image](https://github.com/user-attachments/assets/c0dc90a3-80a1-4ce2-9ba9-5eae9c7852b7)
 
 ### C0042 Snippet
 <details>

micro-behaviors/process/create-process.md

@@ -62,18 +62,18 @@ Malware creates a process.
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[create process on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-windows.yml)|Create Process (C0017)|kernel32.WinExec, kernel32.CreateProcess, shell32.ShellExecute, shell32.ShellExecuteEx, advapi32.CreateProcessAsUser, advapi32.CreateProcessWithLogon, advapi32.CreateProcessWithToken, kernel32.CreateProcessInternal, ntdll.NtCreateUserProcess, ntdll.NtCreateProcess, ntdll.NtCreateProcessEx, ntdll.ZwCreateProcess, ZwCreateProcessEx, ntdll.ZwCreateUserProcess, ntdll.RtlCreateUserProcess, System.Diagnostics.Process::Start|
-|[create process on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-linux.yml)|Create Process (C0017)|execve, execl, execlp, execle, execv, execvp, execvpe, posix_spawn, posix_spawnp, popen|
+|[create process on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-linux.yml)|Create Process (C0017)|execve, execl, execlp, execle, execv, execvp, execvpe, posix_spawn, posix_spawnp, popen, fork|
 |[execute command](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/execute-command.yml)|Create Process (C0017)|system, _system, wsystem, _wsystem|
 |[create a process with modified I/O handles and window](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml)|Create Process (C0017)|kernel32.CreateProcess, kernel32.CreateProcessInternal, advapi32.CreateProcessAsUser, advapi32.CreateProcessWithLogon, advapi32.CreateProcessWithToken, kernel32.GetStartupInfo, System.Diagnostics.Process::Start|
 |[create process suspended](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-suspended.yml)|Create Process::Create Suspended Process (C0017.003)|kernel32.CreateProcess, advapi32.CreateProcessAsUser|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[stealth_system_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_system_procname.py)|Create Process (C0017)|ShellExecuteExW, CreateProcessInternalW|
-|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_process_create.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW|
-|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_create_process.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW|
-|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_create_process.py)|Create Process::Create Process via WMI (C0017.002)|NtCreateUserProcess, CreateProcessInternalW|
-|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_created_process.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[stealth_system_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_system_procname.py)|StealthSystemProcName|Create Process (C0017)|ShellExecuteExW, CreateProcessInternalW|
+|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|StackPivotProcessCreate|Create Process (C0017)|CreateProcessInternalW,  NtCreateUserProcess|
+|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wmi.py)|WMICreateProcess|Create Process (C0017)| CreateProcessInternalW, NtCreateUserProcess|
+|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wmi.py)|WMICreateProcess|Create Process::Create Process via WMI (C0017.002)| CreateProcessInternalW, NtCreateUserProcess|
+|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|ScriptCreatedProcess|Create Process (C0017)|CreateProcessInternalW, NtCreateUserProcess|
 
 ### C0049 Snippet
 <details>

micro-behaviors/process/create-thread.md

@@ -48,11 +48,11 @@ Malware creates a thread.
 |[create thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/create/create-thread.yml)|Create Thread (C0038)|kernel32.CreateThread, _beginthread, _beginthreadex, PsCreateSystemThread, SHCreateThread, SHCreateThreadWithHandle, kernel32.CreateRemoteThread, kernel32.CreateRemoteThreadEx, RtlCreateUserThread, ntdll.NtCreateThread, ntdll.NtCreateThreadEx, ntdll.ZwCreateThread, ntdll.ZwCreateThreadEx, pthread_create, System.Threading.Thread::Start, System.Threading.Thread::ctor|
 |[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Create Thread (C0038)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[injection_create_remote_thread](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Create Thread (C0038)|--|
-|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntcreatethreadex.py)|Create Thread (C0038)|NtCreateThreadEx|
-|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Create Thread (C0038)|NtSetInformationThread|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|---|---|---|
+|[injection_create_remote_thread](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_InjectionCreateRemoteThread|Create Thread (C0038)|--|
+|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntcreatethreadex.py)|antidebug_ntcreatethreadex|Create Thread (C0038)|NtCreateThreadEx|
+|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntsetinformationthread.py)|antidebug_ntsetinformationthread|Create Thread (C0038)|NtSetInformationThread|
 
 ### C0038 Snippet
 <details>

micro-behaviors/process/set-thread-local-storage-value.md

@@ -45,7 +45,7 @@ Malware allocates thread local storage.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue|
+|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/tls/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue|
 
 ### C0041 Snippet
 <details>

micro-behaviors/process/synchronization.md

@@ -1,37 +0,0 @@
-<table>
-<tr>
-<td><b>ID</b></td>
-<td><b>C0022</b></td>
-</tr>
-<tr>
-<td><b>Objective(s)</b></td>
-<td><b><a href="../process">Process</a></b></td>
-</tr>
-<tr>
-<td><b>Related ATT&CK Techniques</b></td>
-<td><b>None</b></td>
-</tr>
-<tr>
-<td><b>Version</b></td>
-<td><b>2.0</b></td>
-</tr>
-<tr>
-<td><b>Created</b></td>
-<td><b>14 August 2020</b></td>
-</tr>
-<tr>
-<td><b>Last Modified</b></td>
-<td><b>10 November 2022</b></td>
-</tr>
-</table>
-
-
-# Synchronization
-
-Malware enables two or more processes/threads to share a resource. 
-
-## Methods
-
-|Name|ID|Description|
-|---|---|---|
-|**Create Mutex**|C0022.001|Malware creates a mutex to enable synchronization.|

micro-behaviors/process/terminate-process.md

@@ -52,9 +52,9 @@ Malware terminates a process.
 |[terminate process via kill](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process-via-kill.yml)|Terminate Process (C0018)|kill|
 |[terminate process](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process.yml)|Terminate Process (C0018)|System.Diagnostics.Process::Kill, System.Diagnostics.Process::WaitForExit, System.Diagnostics.Process::WaitForExitAsync, System.Environment::Exit, System.Windows.Forms.Application::Exit, kernel32.TerminateProcess, ntdll.NtTerminateProcess, kernel32.ExitProcess|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[terminates_remote_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/terminates_remote_process.py)|Terminate Process (C0018)|NtTerminateProcess|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[terminates_remote_process](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/terminates_process.py)|TerminatesRemoteProcess|Terminate Process (C0018)|NtTerminateProcess|
 
 ### C0018 Snippet
 <details>

xample-malware/dnschanger.md

@@ -37,13 +37,6 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev
 |[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|DNSChanger sets file attributes. [[2]](#2)|
 |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|DNSChanger accesses PE headers. [[2]](#2)|
 
-## ATT&CK Techniques
-
-|Name|Use|
-|---|---|
-|[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Set file attributes (This capa rule had 1 match) [[2]](#2)|
-|[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Access PE header (This capa rule had 3 matches) [[2]](#2)|
-
 ## Enhanced ATT&CK Techniques
 
 |Name|Use|

xample-malware/emotet.md

@@ -45,13 +45,6 @@ Emotet is a banking trojan. [[1]](#1)
 |[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [[1]](#1)|
 |[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Emotet writes clipboard data. [[6]](#6)|
 
-|Name|Use|
-|---|---|
-|[Anti-Static Analysis::Software Packing::Custom Compression (F0001.005)](../anti-static-analysis/software-packing.md)|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load emotet's main payloads [[2]](#2)|
-|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Collects information related to os, processes, and sometimes mail client information and sends it to c2 [[2]](#2)|
-|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|To start itself at system boot, emotet adds the downloaded payload to the registry to maintain persistence [[1]](#1)|
-|[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Write clipboard data (this capa rule had 1 match) [[6]](#6)|
-
 ## MBC Behaviors
 
 |Name|Use|

xample-malware/gamut.md

@@ -62,7 +62,7 @@ Gamut is a spamming botnet.
 |[Impact::Spamming (B0039)](../impact/spamming.md)|If port 25 is open, the bot uses a spam template and email list to send spam. [[1]](#1)|
 |[Data::Checksum::CRC32 (C0032.001)](../micro-behaviors/data/checksum.md)|Gamut hashes data with CRC32. [[3]](#3)|
 |[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Gamut encodes data using XOR. [[3]](#3)|
-|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Enumerate PE sections (This capa rule had 1 match) [[3]](#3)|
+|[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Gemut enumerates PE sections. [[3]](#3)|
 |[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Gamut contains an embedded PE file. [[3]](#3)|
 |[File System::Create Directory (C0046)](../micro-behaviors/file-system/create-directory.md)|Gamut creates directories. [[3]](#3)|
 |[File System::Delete Directory (C0048)](../micro-behaviors/file-system/delete-directory.md)|Gamut deletes directories. [[3]](#3)|

ynewsletters/12092024.md

@@ -0,0 +1,15 @@
+# <a name="faq"></a>Malware Behavior Catalog Newsletter # 
+**December 9, 2024**
+
+Hello everyone!
+
+Here are recent MBC developments:
+
+* Released [MBC 3.2](https://github.com/MBCProject/mbc-markdown/releases/tag/v3.2).
+* Released the [STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2.1) for MBC 3.2, which is based on the [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9).
+* Updated the [visual representation](https://raw.githubusercontent.com/MBCProject/mbc-markdown/master/yfaq/mbc_matrix_with_ids.svg) of MBC.
+* Updated MBC-CAPE signature mappings/links (thanks @RazviOverflow!)
+* Added new method: Anti-Static Analysis::Disassembler Evasion::Fake Function (thanks @utkonos!)
+* Reviewed capa to identify mapping suggestions (none found).
+
+Please post questions or comments in [Discussions](https://github.com/MBCProject/mbc-markdown/discussions) on GitHub, or email us at mbc@mitre.org. Feedback is always appreciated! 

ynewsletters/README.md

@@ -1,5 +1,7 @@
 ## <a name="faq"></a>Malware Behavior Catalog Newsletters ##
 
+<a href="./12092024.md">December 2024</a>
+
 <a href="./05012024.md">May 2024</a>
 
 <a href="./12182023.md">December 2023</a>