--- id: "mbc_behavior_id" kind: "datatype" status: "draft" is_pii: false categories: ["software"] langs: ["common"] quality: 75 url: "https://registry.apicrafter.io/datatype/mbc_behavior_id" --- # MBC behavior ID (`mbc_behavior_id`) > **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions. Identifier of a behavior, micro-behavior or method in the Malware Behavior Catalog (MBC), the MITRE catalog of malware objectives and behaviors that complements ATT&CK and that malware analysis tools such as capa and CAPE map their results to. The letter shows the kind: B for an MBC behavior, C for a micro-behavior, E for an ATT&CK technique enhanced for malware (E1027 enhances T1027) and F for an enhanced ATT&CK sub-technique, followed by four digits. A method adds a dot and three digits to B, C and F identifiers (C0029.003), or .m and two digits to E identifiers (E1027.m02). VirusTotal behavior reports list them with links to the MBC project. Objectives have their own identifiers (mbc_objective_id). - Personal data (PII): no - Categories: Software development (software) - Countries: global - Languages: Common to most languages (common) - Classification: identifier ## Detection Regular expression (Python `re`): ``` ^(?:[BCF][0-9]{4}(?:\.[0-9]{3})?|E[0-9]{4}(?:\.m[0-9]{2})?)$ ``` ## Examples - `B0001` — Debugger Detection - `C0029.003` — Cryptographic Hash, method SHA256 (micro-behavior) - `E1027` — Obfuscated Files or Information - `E1027.m02` — Obfuscated Files or Information, method Encoding - Standard Algorithm - `F0001.013` — Software Packing, method ASPack - `T1027` (invalid example) — ATT&CK technique ID (mitre_attack_technique_id) - `E1027.002` (invalid example) — Method of an E behavior needs the m prefix - `OB0001` (invalid example) — Objective ID (mbc_objective_id) ## Sources - doc: ## Quality Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage. JSON: · Edit: