{
  "id": "mbc_behavior_id",
  "kind": "datatype",
  "status": "draft",
  "name": "MBC behavior ID",
  "doc": "Identifier of a behavior, micro-behavior or method in the Malware Behavior Catalog (MBC), the MITRE catalog of malware objectives and behaviors that complements ATT&CK and that malware analysis tools such as capa and CAPE map their results to. The letter shows the kind: B for an MBC behavior, C for a micro-behavior, E for an ATT&CK technique enhanced for malware (E1027 enhances T1027) and F for an enhanced ATT&CK sub-technique, followed by four digits. A method adds a dot and three digits to B, C and F identifiers (C0029.003), or .m and two digits to E identifiers (E1027.m02). VirusTotal behavior reports list them with links to the MBC project. Objectives have their own identifiers (mbc_objective_id).",
  "is_pii": false,
  "categories": [
    "software"
  ],
  "langs": [
    "common"
  ],
  "classification": "identifier",
  "regexp": "^(?:[BCF][0-9]{4}(?:\\.[0-9]{3})?|E[0-9]{4}(?:\\.m[0-9]{2})?)$",
  "examples": [
    {
      "value": "B0001",
      "description": "Debugger Detection",
      "valid": true
    },
    {
      "value": "C0029.003",
      "description": "Cryptographic Hash, method SHA256 (micro-behavior)",
      "valid": true
    },
    {
      "value": "E1027",
      "description": "Obfuscated Files or Information",
      "valid": true
    },
    {
      "value": "E1027.m02",
      "description": "Obfuscated Files or Information, method Encoding - Standard Algorithm",
      "valid": true
    },
    {
      "value": "F0001.013",
      "description": "Software Packing, method ASPack",
      "valid": true
    },
    {
      "value": "T1027",
      "description": "ATT&CK technique ID (mitre_attack_technique_id)",
      "valid": false
    },
    {
      "value": "E1027.002",
      "description": "Method of an E behavior needs the m prefix",
      "valid": false
    },
    {
      "value": "OB0001",
      "description": "Objective ID (mbc_objective_id)",
      "valid": false
    }
  ],
  "links": [
    {
      "type": "doc",
      "url": "https://github.com/MBCProject/mbc-markdown#identifiers"
    }
  ],
  "quality": {
    "score": 75,
    "missing": [
      "mapping (Wikidata, Schema.org, ...)",
      "translation",
      "detector coverage"
    ]
  },
  "source": {
    "path": "data/datatypes/any/software/mbc_behavior_id.yaml",
    "url": "https://github.com/apicrafter/metacrafter-registry/blob/main/data/datatypes/any/software/mbc_behavior_id.yaml",
    "edit_url": "https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/mbc_behavior_id.yaml"
  },
  "urls": {
    "html": "https://registry.apicrafter.io/datatype/mbc_behavior_id",
    "json": "https://registry.apicrafter.io/api/v1/datatypes/mbc_behavior_id.json"
  }
}