Metacrafter Registry

Datatypes

MBC behavior ID

ID mbc_behavior_id

DatatypeNot PIIidentifierDraft

This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).

Identifier of a behavior, micro-behavior or method in the Malware Behavior Catalog (MBC), the MITRE catalog of malware objectives and behaviors that complements ATT&CK and that malware analysis tools such as capa and CAPE map their results to. The letter shows the kind: B for an MBC behavior, C for a micro-behavior, E for an ATT&CK technique enhanced for malware (E1027 enhances T1027) and F for an enhanced ATT&CK sub-technique, followed by four digits. A method adds a dot and three digits to B, C and F identifiers (C0029.003), or .m and two digits to E identifiers (E1027.m02). VirusTotal behavior reports list them with links to the MBC project. Objectives have their own identifiers (mbc_objective_id).

Categories
Software development
Countries
Global (not tied to a country)
Languages
Common to most languages
Quality
75/100 · missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage
Metacrafter rules
no detection rule yet
Supported by tools
no tool record lists this type yet

Regular expression

^(?:[BCF][0-9]{4}(?:\.[0-9]{3})?|E[0-9]{4}(?:\.m[0-9]{2})?)$

Python re syntax.

Examples

ValueDescription
B0001Debugger Detection
C0029.003Cryptographic Hash, method SHA256 (micro-behavior)
E1027Obfuscated Files or Information
E1027.m02Obfuscated Files or Information, method Encoding - Standard Algorithm
F0001.013Software Packing, method ASPack
T1027 invalidATT&CK technique ID (mitre_attack_technique_id)
E1027.002 invalidMethod of an E behavior needs the m prefix
OB0001 invalidObjective ID (mbc_objective_id)

Sources

Use this record