update content per issue 27

impact/README.md

@@ -13,7 +13,7 @@ Behaviors that enable malware to achieve its mission of manipulating, interrupti
 * **Data Encrypted for Impact** [E1486](../impact/encrypt-impact.md)
 * **Denial of Service** [B0033](../impact/denial-of-service.md)
 * **Destroy Hardware** [B0017](../impact/destroy-hardware.md)
-* **Disk Content Wipe** [F0014](../impact/disk-content-wipe.md)
+* **Disk Wipe** [F0014](../impact/disk-wipe.md)
 * **Exploit Kit Behavior** [E1190](../impact/exploit-kit-behavior.md)
 * **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
 * **Generate Fraudulent Advertising Revenue** [E1472](../impact/generate-fraud-rev.md)

impact/data-destruction.md

@@ -16,6 +16,7 @@ Methods
 |Name|ID|Description|
 |---|---|---|
 |**Delete Application/Software**|E1485.m03|An application or software is deleted.|
+|**Delete Shadow Copies**|E1485.m04|Deletes shadow drive data, which is related to ransomware.|
 |**Empty Recycle Bin**|E1485.m02|Empties the recycle bin, which can be related to ransomware.|
 
 Malware Examples

impact/disk-wipe.md

@@ -0,0 +1,11 @@
+|||
+|---|---|
+|**ID**|**F0014**|
+|**Objective(s)**|[Impact](../impact)|
+|**Related ATT&CK Sub-Technique**|[Disk Wipe](https://attack.mitre.org/techniques/T1561/)|
+
+Disk Wipe
+=========
+Malware may erase the content of storage devices. This behavior is different than [Data Destruction](../impact/data-destruction.md) because sections of the disk are erased rather than individual files.
+
+This description refines the ATT&CK [**Disk Wipe**](https://attack.mitre.org/techniques/T1561/) sub-technique.