@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
@prefix mcr: <https://registry.apicrafter.io/vocab#> .
@prefix dt: <https://registry.apicrafter.io/datatype/> .
@prefix cat: <https://registry.apicrafter.io/category/> .
@prefix country: <https://registry.apicrafter.io/country/> .
@prefix tool: <https://registry.apicrafter.io/tool/> .

dt:mbc_behavior_id a skos:Concept ;
    skos:inScheme <https://registry.apicrafter.io/> ;
    skos:topConceptOf <https://registry.apicrafter.io/> ;
    skos:notation "mbc_behavior_id" ;
    skos:prefLabel "MBC behavior ID"@en ;
    skos:definition "Identifier of a behavior, micro-behavior or method in the Malware Behavior Catalog (MBC), the MITRE catalog of malware objectives and behaviors that complements ATT&CK and that malware analysis tools such as capa and CAPE map their results to. The letter shows the kind: B for an MBC behavior, C for a micro-behavior, E for an ATT&CK technique enhanced for malware (E1027 enhances T1027) and F for an enhanced ATT&CK sub-technique, followed by four digits. A method adds a dot and three digits to B, C and F identifiers (C0029.003), or .m and two digits to E identifiers (E1027.m02). VirusTotal behavior reports list them with links to the MBC project. Objectives have their own identifiers (mbc_objective_id)."@en ;
    skos:example "B0001" ;
    skos:example "C0029.003" ;
    skos:example "E1027" ;
    skos:example "E1027.m02" ;
    skos:example "F0001.013" ;
    mcr:status "draft" ;
    mcr:isPII false ;
    mcr:classification "identifier" ;
    mcr:regexp "^(?:[BCF][0-9]{4}(?:\\.[0-9]{3})?|E[0-9]{4}(?:\\.m[0-9]{2})?)$" ;
    rdfs:seeAlso <https://github.com/MBCProject/mbc-markdown#identifiers> .