September 9, 2022
Hello all!
Highlights of recent MBC development include:
- Released MBC v2.3, which aligns MBC with ATT&CK v11 (plus other updates*)
- Released v22.09 of the STIX 2 representation for MBC v2.3
- Updated capa rules to map to MBC v2.3
- Expanded MBC's malware corpus of mapped malware examples
- Began meeting with MBC users to understand their use cases
Next, we'll be considering questions, such as whether the MBC's terminology should more closely match ATT&CK's. For example, should MBC "behaviors" instead be referred to as "techniques"? We'll also be expanding the malware corpus, as well as adding code snippets to MBC behavior pages. Please email us at [email protected] to let us know what you think.
Please let us know if you're interested in meeting with our team. We'd love to get your feedback and understand your MBC use cases!
Other updates include:
- Behavior/method descriptions enhanced
- HTML tables fixed inside markdown
- Histograms added for capa mappings
- Malware corpus documentation expanded
- READMEs updated
- Markdown file names updated to match behavior names
- ATT&CK technique identifiers added to links
- Table of MBC behaviors added
- Behavior page content (order and wording) updated for consistency