Skip to content

Class: AttackCampaign

Campaigns represent a grouping of adversary behaviors and resources with a common objective, occurring over a defined time period. A campaign may be attributed to one or more Groups via 'attributed-to' relationships.

Campaigns require mandatory temporal properties: first_seen and last_seen document when the campaign was active, and the corresponding citation properties (x_mitre_first_seen_citation, x_mitre_last_seen_citation) cite the intelligence sources that established those observations.

The aliases array is required; its first entry MUST match the campaign's name.

URI: attack:AttackCampaign

 classDiagram
    class AttackCampaign
    click AttackCampaign href "../AttackCampaign/"
      AttackObject <|-- AttackCampaign
        click AttackObject href "../AttackObject/"

      AttackCampaign : confidence

      AttackCampaign : created

      AttackCampaign : created_by_ref

      AttackCampaign : description

      AttackCampaign : extensions

      AttackCampaign : external_references





        AttackCampaign --> "1..*" ExternalReference : external_references
        click ExternalReference href "../ExternalReference/"



      AttackCampaign : granular_markings





        AttackCampaign --> "*" GranularMarking : granular_markings
        click GranularMarking href "../GranularMarking/"



      AttackCampaign : id

      AttackCampaign : labels

      AttackCampaign : lang

      AttackCampaign : modified

      AttackCampaign : name

      AttackCampaign : object_marking_refs

      AttackCampaign : revoked

      AttackCampaign : spec_version





        AttackCampaign --> "1" SpecVersionEnum : spec_version
        click SpecVersionEnum href "../SpecVersionEnum/"



      AttackCampaign : type

      AttackCampaign : x_mitre_attack_spec_version

      AttackCampaign : x_mitre_contributors

      AttackCampaign : x_mitre_deprecated

      AttackCampaign : x_mitre_domains





        AttackCampaign --> "1..*" AttackDomainEnum : x_mitre_domains
        click AttackDomainEnum href "../AttackDomainEnum/"



      AttackCampaign : x_mitre_first_seen_citation

      AttackCampaign : x_mitre_last_seen_citation

      AttackCampaign : x_mitre_modified_by_ref

      AttackCampaign : x_mitre_old_attack_id

      AttackCampaign : x_mitre_version

Inheritance

Slots

Name Cardinality and Range Description Inheritance
x_mitre_domains 1..*
AttackDomainEnum		 The ATT&CK technology domains to which this object belongs direct
x_mitre_contributors *
String		 Names of people and organizations who have contributed to the creation or enr... direct
x_mitre_modified_by_ref 1
StixIdentifier		 The STIX ID of the identity object that created the current version of this o... direct
x_mitre_first_seen_citation 1
CitationString		 One or more inline citation references documenting the original sources that ... direct
x_mitre_last_seen_citation 1
CitationString		 One or more inline citation references documenting the original sources that ... direct
x_mitre_attack_spec_version 1
SemverString		 The version of the ATT&CK Data Model specification used to construct this obj... AttackObject
x_mitre_version 1
AttackVersionString		 The version of this ATT&CK object content in 'major AttackObject
x_mitre_deprecated 0..1
Boolean		 Boolean flag indicating that this ATT&CK object has been deprecated and shoul... AttackObject
x_mitre_old_attack_id 0..1
String		 A legacy ATT&CK ID previously assigned to this object before a knowledge base... AttackObject
type 1
StixTypeName		 STIX object type Core, StixEntity
spec_version 1
SpecVersionEnum		 STIX specification version Core
id 1
StixIdentifier		 STIX object identifier Core, StixEntity
created 1
Datetime		 Creation timestamp Core
modified 1
Datetime		 Modification timestamp Core
created_by_ref 1
StixIdentifier		 The STIX ID of the identity object that first created this ATT&CK object Core
labels *
String		 Terms used to describe this object Core
revoked 1
Boolean		 Required on Campaign objects Core
confidence 0..1
Integer		 Confidence that the producer has in this data Core
lang 0..1
String		 Language of textual properties Core
external_references 1..*
ExternalReference		 External references Core
object_marking_refs 1..*
StixIdentifier		 Marking definition references applied to this object Core
granular_markings *
GranularMarking		 Granular markings that apply to selected content Core
extensions *
String		 Open-ended extension payloads Core
name 1
String		 The campaign's primary name or identifier (e StixEntity
description 1
String		 A description of the campaign, including its objectives, targeted sectors, ob... StixEntity

In Subsets

Comments

  • validator_hint: first-aliases-entry-must-match-name validator_hint: citations-must-reference-valid-external-reference-source-names

Notes

  • The class name 'attack:Campaign' collides with 'stix:Campaign', so renamed.

Identifier and Mapping Information

Annotations

property value
stix_type campaign
attack_id_format C####

Schema Source

  • from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type Mapped Value
self attack:AttackCampaign
native attack:AttackCampaign

LinkML Source

Direct

name: AttackCampaign
annotations:
  stix_type:
    tag: stix_type
    value: campaign
  attack_id_format:
    tag: attack_id_format
    value: C####
description: 'Campaigns represent a grouping of adversary behaviors and resources
  with a common objective, occurring over a defined time period. A campaign may be
  attributed to one or more Groups via ''attributed-to'' relationships.

  Campaigns require mandatory temporal properties: first_seen and last_seen document
  when the campaign was active, and the corresponding citation properties (x_mitre_first_seen_citation,
  x_mitre_last_seen_citation) cite the intelligence sources that established those
  observations.

  The aliases array is required; its first entry MUST match the campaign''s name.'
notes:
- The class name 'attack:Campaign' collides with 'stix:Campaign', so renamed.
comments:
- 'validator_hint: first-aliases-entry-must-match-name validator_hint: citations-must-reference-valid-external-reference-source-names'
in_subset:
- attack_sdos
from_schema: https://w3id.org/lmodel/attack
is_a: AttackObject
slots:
- x_mitre_domains
- x_mitre_contributors
- x_mitre_modified_by_ref
- x_mitre_first_seen_citation
- x_mitre_last_seen_citation
slot_usage:
  type:
    name: type
    required: true
    pattern: ^campaign$
  id:
    name: id
    required: true
    pattern: ^campaign--
  name:
    name: name
    description: The campaign's primary name or identifier (e.g., 'Operation Wocao',
      'C0001').
    required: true
  description:
    name: description
    description: A description of the campaign, including its objectives, targeted
      sectors, observed techniques, and any notable characteristics.
    required: true
  external_references:
    name: external_references
    description: External references. The first entry MUST have source_name 'mitre-attack'
      and contain the campaign's ATT&CK ID as external_id (e.g., 'C0001').
    comments:
    - 'validator_hint: first-ref-must-be-mitre-attack-campaign-id jsonschema_minItems:
      "1"'
    required: true
  created_by_ref:
    name: created_by_ref
    required: true
  object_marking_refs:
    name: object_marking_refs
    required: true
  revoked:
    name: revoked
    description: Required on Campaign objects. Indicates whether this campaign has
      been revoked and superseded by another campaign object.
    required: true
  aliases:
    name: aliases
    description: Alternative names for this campaign. Required; the first alias MUST
      match the campaign's name property.
    required: true
  first_seen:
    name: first_seen
    description: The date when this campaign was first observed. Required on ATT&CK
      Campaign objects; optional in STIX.
    required: true
  last_seen:
    name: last_seen
    description: The date when this campaign was most recently observed. Required
      on ATT&CK Campaign objects; optional in STIX.
    required: true
  x_mitre_domains:
    name: x_mitre_domains
    required: true
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    required: true
  x_mitre_first_seen_citation:
    name: x_mitre_first_seen_citation
    required: true
  x_mitre_last_seen_citation:
    name: x_mitre_last_seen_citation
    required: true

Induced

name: AttackCampaign
annotations:
  stix_type:
    tag: stix_type
    value: campaign
  attack_id_format:
    tag: attack_id_format
    value: C####
description: 'Campaigns represent a grouping of adversary behaviors and resources
  with a common objective, occurring over a defined time period. A campaign may be
  attributed to one or more Groups via ''attributed-to'' relationships.

  Campaigns require mandatory temporal properties: first_seen and last_seen document
  when the campaign was active, and the corresponding citation properties (x_mitre_first_seen_citation,
  x_mitre_last_seen_citation) cite the intelligence sources that established those
  observations.

  The aliases array is required; its first entry MUST match the campaign''s name.'
notes:
- The class name 'attack:Campaign' collides with 'stix:Campaign', so renamed.
comments:
- 'validator_hint: first-aliases-entry-must-match-name validator_hint: citations-must-reference-valid-external-reference-source-names'
in_subset:
- attack_sdos
from_schema: https://w3id.org/lmodel/attack
is_a: AttackObject
slot_usage:
  type:
    name: type
    required: true
    pattern: ^campaign$
  id:
    name: id
    required: true
    pattern: ^campaign--
  name:
    name: name
    description: The campaign's primary name or identifier (e.g., 'Operation Wocao',
      'C0001').
    required: true
  description:
    name: description
    description: A description of the campaign, including its objectives, targeted
      sectors, observed techniques, and any notable characteristics.
    required: true
  external_references:
    name: external_references
    description: External references. The first entry MUST have source_name 'mitre-attack'
      and contain the campaign's ATT&CK ID as external_id (e.g., 'C0001').
    comments:
    - 'validator_hint: first-ref-must-be-mitre-attack-campaign-id jsonschema_minItems:
      "1"'
    required: true
  created_by_ref:
    name: created_by_ref
    required: true
  object_marking_refs:
    name: object_marking_refs
    required: true
  revoked:
    name: revoked
    description: Required on Campaign objects. Indicates whether this campaign has
      been revoked and superseded by another campaign object.
    required: true
  aliases:
    name: aliases
    description: Alternative names for this campaign. Required; the first alias MUST
      match the campaign's name property.
    required: true
  first_seen:
    name: first_seen
    description: The date when this campaign was first observed. Required on ATT&CK
      Campaign objects; optional in STIX.
    required: true
  last_seen:
    name: last_seen
    description: The date when this campaign was most recently observed. Required
      on ATT&CK Campaign objects; optional in STIX.
    required: true
  x_mitre_domains:
    name: x_mitre_domains
    required: true
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    required: true
  x_mitre_first_seen_citation:
    name: x_mitre_first_seen_citation
    required: true
  x_mitre_last_seen_citation:
    name: x_mitre_last_seen_citation
    required: true
attributes:
  x_mitre_domains:
    name: x_mitre_domains
    description: The ATT&CK technology domains to which this object belongs. At least
      one domain must be specified. An object may belong to multiple domains when
      the same technique, group, or software is relevant across domain boundaries.
    comments:
    - 'jsonschema_minItems: "1"'
    in_subset:
    - attack_sdos
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_domains
    owner: AttackCampaign
    domain_of:
    - Technique
    - Tactic
    - Group
    - AttackCampaign
    - Mitigation
    - AttackMalware
    - AttackTool
    - Asset
    - DataSource
    - DataComponent
    - Matrix
    - DetectionStrategy
    - Analytic
    range: AttackDomainEnum
    required: true
    multivalued: true
  x_mitre_contributors:
    name: x_mitre_contributors
    description: Names of people and organizations who have contributed to the creation
      or enrichment of this ATT&CK object. Contributors are credited for providing
      information, examples, or analysis that informed the object's content. Not present
      on relationship objects.
    in_subset:
    - attack_sdos
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_contributors
    owner: AttackCampaign
    domain_of:
    - Technique
    - Tactic
    - Group
    - AttackCampaign
    - Mitigation
    - AttackMalware
    - AttackTool
    - Asset
    - DataSource
    - DetectionStrategy
    range: string
    multivalued: true
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    description: 'The STIX ID of the identity object that created the current version
      of this object. In practice, always references MITRE''s canonical identity object:
      identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5. May differ from created_by_ref
      if the object was originally created by a third party and subsequently adopted
      or updated by MITRE.'
    comments:
    - 'validator_hint: must-match-mitre-identity-id'
    in_subset:
    - attack_sdos
    - attack_sros
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_modified_by_ref
    owner: AttackCampaign
    domain_of:
    - Technique
    - Tactic
    - Group
    - AttackCampaign
    - Mitigation
    - AttackMalware
    - AttackTool
    - Asset
    - DataSource
    - DataComponent
    - Matrix
    - Collection
    - DetectionStrategy
    - Analytic
    - AttackRelationship
    range: stix_identifier
    required: true
    pattern: ^identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5$
  x_mitre_first_seen_citation:
    name: x_mitre_first_seen_citation
    description: 'One or more inline citation references documenting the original
      sources that established when this campaign was first observed. Each citation
      references a source_name from the object''s external_references array. Multiple
      citations are concatenated without separators: ''(Citation: Source1)(Citation:
      Source2)''. This property is required on all Campaign objects.'
    in_subset:
    - attack_sdos
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_first_seen_citation
    owner: AttackCampaign
    domain_of:
    - AttackCampaign
    range: citation_string
    required: true
  x_mitre_last_seen_citation:
    name: x_mitre_last_seen_citation
    description: 'One or more inline citation references documenting the original
      sources that established when this campaign was last observed. Each citation
      references a source_name from the object''s external_references array. Multiple
      citations are concatenated without separators: ''(Citation: Source1)(Citation:
      Source2)''. This property is required on all Campaign objects.'
    in_subset:
    - attack_sdos
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_last_seen_citation
    owner: AttackCampaign
    domain_of:
    - AttackCampaign
    range: citation_string
    required: true
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    description: The version of the ATT&CK Data Model specification used to construct
      this object, in MAJOR.MINOR.PATCH (semantic versioning) format. Helps consuming
      software determine whether the data format is supported. Objects lacking this
      property are assumed to conform to ATT&CK spec version 2.0.0. Refer to the ATT&CK
      CHANGELOG for all supported versions.
    comments:
    - 'absent_on: marking-definition, identity (x_mitre_version absent), relationship
      (x_mitre_version absent)'
    in_subset:
    - attack_sdos
    - attack_sros
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_attack_spec_version
    owner: AttackCampaign
    domain_of:
    - AttackObject
    range: semver_string
    required: true
  x_mitre_version:
    name: x_mitre_version
    description: 'The version of this ATT&CK object content in ''major.minor'' format,
      where both components are integers between 0 and 99. Incremented by ATT&CK whenever
      the substantive content of the object changes. Does not apply to relationship
      objects. Example: "1.0", "12.5".'
    comments:
    - 'absent_on: relationship, marking-definition'
    in_subset:
    - attack_sdos
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_version
    owner: AttackCampaign
    domain_of:
    - AttackObject
    range: attack_version_string
    required: true
  x_mitre_deprecated:
    name: x_mitre_deprecated
    description: Boolean flag indicating that this ATT&CK object has been deprecated
      and should no longer be used in new analyses or tooling implementations. Deprecated
      objects are retained in the knowledge base for historical reference and legacy
      compatibility, but are not actively maintained with new information.
    comments:
    - 'absent_on: marking-definition'
    in_subset:
    - attack_sdos
    - attack_sros
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_deprecated
    owner: AttackCampaign
    domain_of:
    - AttackObject
    range: boolean
  x_mitre_old_attack_id:
    name: x_mitre_old_attack_id
    description: A legacy ATT&CK ID previously assigned to this object before a knowledge
      base restructuring or domain migration event. Format mirrors the current ATT&CK
      ID format but from the prior numbering scheme (e.g., "MOB-T1001" for a mobile
      technique previously in the pre-unification Mobile ATT&CK dataset).
    in_subset:
    - attack_sdos
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: x_mitre_old_attack_id
    owner: AttackCampaign
    domain_of:
    - AttackObject
    range: string
  type:
    name: type
    description: STIX object type.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:state
    rank: 1000
    alias: type
    owner: AttackCampaign
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_type_name
    required: true
    pattern: ^campaign$
  spec_version:
    name: spec_version
    description: STIX specification version.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:specVersion
    rank: 1000
    alias: spec_version
    owner: AttackCampaign
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: SpecVersionEnum
    required: true
  id:
    name: id
    description: STIX object identifier.
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: id
    owner: AttackCampaign
    domain_of:
    - StixEntity
    - Bundle
    - Core
    - CyberObservableCore
    - ExtensionDefinition
    - LanguageContent
    - MarkingDefinition
    - File
    range: stix_identifier
    required: true
    pattern: ^campaign--
  created:
    name: created
    description: Creation timestamp.
    notes:
    - STIX core timestamps require millisecond precision.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:objectCreatedTime
    rank: 1000
    alias: created
    owner: AttackCampaign
    domain_of:
    - Core
    - MarkingDefinition
    range: datetime
    required: true
    pattern: T\d{2}:\d{2}:\d{2}\.\d{3,}Z$
  modified:
    name: modified
    description: Modification timestamp.
    notes:
    - STIX core timestamps require millisecond precision.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:modifiedTime
    rank: 1000
    alias: modified
    owner: AttackCampaign
    domain_of:
    - Core
    range: datetime
    required: true
    pattern: T\d{2}:\d{2}:\d{2}\.\d{3,}Z$
  created_by_ref:
    name: created_by_ref
    description: The STIX ID of the identity object that first created this ATT&CK
      object. Typically references MITRE's identity (identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5).
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:createdBy
    rank: 1000
    alias: created_by_ref
    owner: AttackCampaign
    domain_of:
    - Core
    - MarkingDefinition
    range: stix_identifier
    required: true
  labels:
    name: labels
    description: Terms used to describe this object.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:tag
    rank: 1000
    alias: labels
    owner: AttackCampaign
    domain_of:
    - Core
    range: string
    multivalued: true
  revoked:
    name: revoked
    description: Required on Campaign objects. Indicates whether this campaign has
      been revoked and superseded by another campaign object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: revoked
    owner: AttackCampaign
    domain_of:
    - Core
    range: boolean
    required: true
  confidence:
    name: confidence
    description: Confidence that the producer has in this data.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: confidence
    owner: AttackCampaign
    domain_of:
    - Core
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: Language of textual properties.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    alias: lang
    owner: AttackCampaign
    domain_of:
    - Core
    - GranularMarking
    range: string
  external_references:
    name: external_references
    description: External references. The first entry MUST have source_name 'mitre-attack'
      and contain the campaign's ATT&CK ID as external_id (e.g., 'C0001').
    comments:
    - 'validator_hint: first-ref-must-be-mitre-attack-campaign-id jsonschema_minItems:
      "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:externalReference
    rank: 1000
    alias: external_references
    owner: AttackCampaign
    domain_of:
    - Core
    - MarkingDefinition
    range: ExternalReference
    required: true
    multivalued: true
  object_marking_refs:
    name: object_marking_refs
    description: Marking definition references applied to this object.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: object_marking_refs
    owner: AttackCampaign
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: stix_identifier
    required: true
    multivalued: true
  granular_markings:
    name: granular_markings
    description: Granular markings that apply to selected content.
    comments:
    - 'jsonschema_minItems: "1"'
    from_schema: https://w3id.org/lmodel/attack
    narrow_mappings:
    - unified_cyber_ontology:objectMarking
    rank: 1000
    alias: granular_markings
    owner: AttackCampaign
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    range: GranularMarking
    multivalued: true
  extensions:
    name: extensions
    description: Open-ended extension payloads.
    notes:
    - JSON Schema uses patternProperties for extension keys; exact key validation
      is delegated to validator tooling.
    comments:
    - 'jsonschema_rule: patternProperties validator_hint: validate-extension-keys-and-values'
    from_schema: https://w3id.org/lmodel/attack
    related_mappings:
    - unified_cyber_ontology:hasFacet
    rank: 1000
    alias: extensions
    owner: AttackCampaign
    domain_of:
    - Core
    - CyberObservableCore
    - MarkingDefinition
    - File
    range: string
    multivalued: true
  name:
    name: name
    description: The campaign's primary name or identifier (e.g., 'Operation Wocao',
      'C0001').
    from_schema: https://w3id.org/lmodel/attack
    exact_mappings:
    - unified_cyber_ontology:name
    rank: 1000
    alias: name
    owner: AttackCampaign
    domain_of:
    - RelatedAsset
    - StixEntity
    - ExtensionDefinition
    - MarkingDefinition
    - AutonomousSystem
    - File
    range: string
    required: true
  description:
    name: description
    description: A description of the campaign, including its objectives, targeted
      sectors, observed techniques, and any notable characteristics.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - unified_cyber_ontology:description
    rank: 1000
    alias: description
    owner: AttackCampaign
    domain_of:
    - RelatedAsset
    - MutableElement
    - StixEntity
    - ExtensionDefinition
    - ExternalReference
    range: string
    required: true