update ATT&CK and MBC mappings

thanks to Regina Elwell @ FireEye and @evandrix
closes #316

anti-analysis/packer/confuser/packed-with-confuser.yml

@@ -7,7 +7,7 @@ rule:
     att&ck:
       - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]
     mbc:
-      - Anti-Static Analysis::Software Packing::Confuser [F0001.012]
+      - Anti-Static Analysis::Software Packing::Confuser [F0001.009]
     examples:
       - b9f5bd514485fb06da39beff051b9fdc
   features:

compiler/pyarmor/compiled-with-pyarmor.yml

@@ -6,6 +6,7 @@ rule:
     scope: file
     att&ck:
       - Execution::Command and Scripting Interpreter::Python [T1059.006]
+      - Defense Evasion::Obfuscated Files or Information::Software Packing [1027.002]
     references:
       - https://twitter.com/stvemillertime/status/1349032548580483073
     examples:

data-manipulation/encoding/base64/encode-data-using-base64.yml

@@ -8,7 +8,7 @@ rule:
       - Defense Evasion::Obfuscated Files or Information [T1027]
     mbc:
       - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]
-      - Data::Encoding::Base64 [C0026.001]
+      - Data::Encode Data::Base64 [C0026.001]
     examples:
       - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C
       - 074072B261FC27B65C72671F13510C05:0x100049B2

data-manipulation/encoding/base64/reference-base64-string.yml

@@ -4,8 +4,10 @@ rule:
     namespace: data-manipulation/encoding/base64
     author: moritz.raabe@fireeye.com
     scope: file
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information [T1027]
     mbc:
-      - Data::Encoding::Base64 [C0026.001]
+      - Data::Encode Data::Base64 [C0026.001]
       - Data::Check String [C0019]
     examples:
       - BFB9B5391A13D0AFD787E87AB90F14F5

data-manipulation/encoding/xor/encode-data-using-xor.yml

@@ -8,7 +8,7 @@ rule:
       - Defense Evasion::Obfuscated Files or Information [T1027]
     mbc:
       - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]
-      - Data::Encoding::XOR [C0026.002]
+      - Data::Encode Data::XOR [C0026.002]
     examples:
       - 2D3EDC218A90F03089CC01715A9F047F:0x403D7E
   features:

host-interaction/file-system/write/write-file.yml

@@ -5,7 +5,7 @@ rule:
     author: william.ballenthin@fireeye.com
     scope: function
     mbc:
-      - File System::Write File [C0052]
+      - File System::Writes File [C0052]
     examples:
       - Practical Malware Analysis Lab 01-04.exe_:0x4011FC
       # ntdll

host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml

@@ -5,7 +5,7 @@ rule:
     author: michael.hunhoff@fireeye.com
     scope: function
     mbc:
-      - Impact::Modify Hardware::CDROM [C0042.001]
+      - Impact::Modify Hardware::CDROM [B0042.001]
     examples:
       - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x10007250
   features:

host-interaction/registry/create-registry-key-via-offline-registry-library.yml

@@ -4,6 +4,8 @@ rule:
     namespace: host-interaction/registry
     author: johnk3r
     scope: function
+    att&ck:
+      - Defense Evasion::Modify Registry [T1112]
     mbc:
       - Operating System::Registry::Create Registry Key [C0036.004]
     examples:

host-interaction/registry/delete/delete-registry-key.yml

@@ -7,6 +7,8 @@ rule:
       - michael.hunhoff@fireeye.com
       - johnk3r
     scope: function
+    att&ck:
+      - Defense Evasion::Modify Registry [T1112]
     mbc:
       - Operating System::Registry::Delete Registry Key [C0036.002]
     examples:

host-interaction/registry/delete/delete-registry-value.yml

@@ -4,6 +4,8 @@ rule:
     namespace: host-interaction/registry/delete
     author: michael.hunhoff@fireeye.com
     scope: function
+    att&ck:
+      - Defense Evasion::Modify Registry [T1112]
     mbc:
       - Operating System::Registry::Delete Registry Value [C0036.007]
     examples:

host-interaction/registry/set-registry-key-via-offline-registry-library.yml

@@ -4,6 +4,8 @@ rule:
     namespace: host-interaction/registry
     author: johnk3r
     scope: function
+    att&ck:
+      - Defense Evasion::Modify Registry [T1112]
     mbc:
       - Operating System::Registry::Set Registry Key [C0036.001]
     examples:

load-code/pe/inject-dll-reflectively.yml

@@ -4,6 +4,8 @@ rule:
     namespace: load-code/pe
     author: "@Ana06"
     scope: function
+    att&ck:
+        - Defense Evasion::Process Injection::Dynamic-link Library Injection [T1055.001]
     references:
       - https://0x00sec.org/t/reflective-dll-injection/3080
       - https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection

nursery/check-for-process-debug-object.yml

@@ -5,7 +5,7 @@ rule:
     author: michael.hunhoff@fireeye.com
     scope: function
     mbc:
-      - Anti-Behavioral Analysis::Detect Debugger
+      - Anti-Behavioral Analysis::Debugger Detection
     references:
       - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtQueryInformationProcess_ProcessDebugObject.cpp
   features:

nursery/check-processdebugflags.yml

@@ -5,7 +5,7 @@ rule:
     author: michael.hunhoff@fireeye.com
     scope: basic block
     mbc:
-      - Anti-Behavioral Analysis::Detect Debugger
+      - Anti-Behavioral Analysis::Debugger Detection
     references:
       - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtQueryInformationProcess_ProcessDebugFlags.cpp
   features:

nursery/check-processdebugport.yml

@@ -5,7 +5,7 @@ rule:
     author: michael.hunhoff@fireeye.com
     scope: basic block
     mbc:
-      - Anti-Behavioral Analysis::Detect Debugger
+      - Anti-Behavioral Analysis::Debugger Detection
     references:
       - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtQueryInformationProcess_ProcessDebugPort.cpp
   features:

nursery/check-systemkerneldebuggerinformation.yml

@@ -5,7 +5,7 @@ rule:
     author: michael.hunhoff@fireeye.com
     scope: basic block
     mbc:
-      - Anti-Behavioral Analysis::Detect Debugger
+      - Anti-Behavioral Analysis::Debugger Detection
     references:
       - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtQuerySystemInformation_SystemKernelDebuggerInformation.cpp
   features:

nursery/check-thread-yield-allowed.yml

@@ -5,7 +5,7 @@ rule:
     author: michael.hunhoff@fireeye.com
     scope: function
     mbc:
-      - Anti-Behavioral Analysis::Detect Debugger
+      - Anti-Behavioral Analysis::Debugger Detection
     references:
       - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtYieldExecution.cpp
   features:

nursery/decode-data-using-base64-via-winapi.yml

@@ -4,6 +4,8 @@ rule:
     namespace: data-manipulation/encoding/base64
     author: michael.hunhoff@fireeye.com
     scope: basic block
+    att&ck:
+      - Defense Evasion::Deobfuscate/Decode Files or Information [T1140]
   features:
     - and:
       - or:

nursery/decrypt-data-via-sspi.yml

@@ -5,7 +5,7 @@ rule:
     author: matthew.williams@fireeye.com
     scope: basic block
     att&ck:
-      - Defense Evasion::Obfuscated Files or Information [T1027]
+      - Defense Evasion::Deobfuscate/Decode Files or Information [T1140]
     references:
       - https://docs.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-decryptmessage
   features:

nursery/delete-registry-key-via-offline-registry-library.yml

@@ -4,6 +4,8 @@ rule:
     namespace: host-interaction/registry
     author: johnk3r
     scope: function
+    att&ck:
+      - Defense Evasion::Modify Registry [T1112]
     mbc:
       - Operating System::Registry::Delete Registry Key [C0036.002]
       - Operating System::Registry::Delete Registry Value [C0036.007]

nursery/encode-data-using-base64-via-winapi.yml

@@ -4,6 +4,8 @@ rule:
     namespace: data-manipulation/encoding/base64
     author: moritz.raabe@fireeye.com
     scope: basic block
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information [T1027]
   features:
     - and:
       - number: 1 = CRYPT_STRING_BASE64

nursery/enumerate-network-shares.yml

@@ -4,6 +4,8 @@ rule:
     namespace: host-interaction/network
     author: michael.hunhoff@fireeye.com
     scope: function
+    att&ck:
+      - Discovery::Network Share Discovery [T1135]
   features:
     - and:
       - or:

nursery/get-user-security-identifier.yml

@@ -5,6 +5,8 @@ rule:
     namespace: host-interaction/sid
     author: michael.hunhoff@fireeye.com
     scope: basic block
+    att&ck:
+        - Discovery::Account Discovery [T1087]
   features:
     - or:
       - api: advapi32.LookupAccountName

nursery/reference-processor-manufacturer-constants.yml

@@ -7,7 +7,7 @@ rule:
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:
-      - Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check
+      - Anti-Behavioral Analysis::Virtual Machine Detection::Instruction Testing - CPUID [B0009.034]
     references:
       - https://en.wikipedia.org/wiki/CPUID
   features:

nursery/reference-the-vmware-io-port.yml

@@ -7,7 +7,7 @@ rule:
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:
-      - Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check
+      - Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - I/O Communication Port [B0009.025]
   features:
     - and:
       - mnemonic: in