| abstract |
A brief summary of the note |
| account_created |
Specifies when the account was created |
| account_expires |
Specifies the expiration date of the account |
| account_first_login |
Specifies when the account was first accessed |
| account_last_login |
Specifies when the account was last accessed |
| account_login |
Specifies the account login string, used in cases where the user_id property … |
| account_type |
The type of the account, such as unix or ldap |
| additional_header_fields |
Specifies any other header fields found in the email message, as a dictionary |
| address_family |
Specifies the address family (AF_*) that the socket is configured for |
| address_of_entry_point |
Specifies the address of the entry point relative to the image base when the … |
| administrative_area |
The state, province, or other sub-national administrative area that this Loca… |
| aliases |
Other names by which the object is known |
| alternate_data_streams |
Specifies a list of NTFS alternate data streams that exist for the file |
| analysis_definition_version |
The version of the analysis definitions used by the analysis tool |
| analysis_ended |
The date and time that the malware analysis ended |
| analysis_engine_version |
The version of the analysis engine or product that was used to perform this a… |
| analysis_sco_refs |
The cyber-observable objects captured during the analysis |
| analysis_started |
The date and time that the malware analysis was initiated |
| architecture_execution_envs |
The processor architectures, such as x86 or ARM, that the malware runs on |
| aslr_enabled |
Specifies whether Address Space Layout Randomization (ASLR) is enabled for th… |
| atime |
The time at which the object was last accessed |
| authority_key_identifier |
Specifies the identifier that provides a means of identifying the public key … |
| authors |
The names of the note’s authors, such as the analysts who wrote it |
| base_of_code |
Specifies the address that is relative to the image base of the beginning-of-… |
| base_of_data |
Specifies the address that is relative to the image base of the beginning-of-… |
| basic_constraints |
Specifies a multi-valued extension which indicates whether a certificate is a… |
| bcc_refs |
Specifies the mailboxes that are ‘BCC:’ recipients of the email message |
| belongs_to_ref |
Specifies the user account that the email address belongs to, as a reference … |
| belongs_to_refs |
References to the autonomous systems that this address belongs to |
| bits_per_pixel |
Specifies the sum of bits used for each color channel in the image in the ima… |
| body |
A body of text |
| body_multipart |
The MIME parts that make up a multipart email body |
| body_raw_ref |
Specifies the contents of non-textual MIME parts, that is those whose content… |
| can_escalate_privs |
Specifies that the account has the ability to escalate privileges (i |
| capabilities |
The capabilities identified in the malware instance or family |
| cc_refs |
Specifies the mailboxes that are ‘CC:’ recipients of the email message |
| certificate_policies |
Specifies a sequence of one or more policy information terms, each of which c… |
| channel |
A channel or event type within a log, such as 1 for process creation in Sysmo… |
| characteristics_hex |
Specifies the flags that indicate the file’s characteristics |
| checksum_hex |
Specifies the checksum of the PE binary |
| child_refs |
Specifies the other processes that were spawned by (i |
| city |
The city that this Location describes |
| command_line |
Specifies the full command line used in executing the process, including the … |
| comment |
Specifies a comment included as part of the archive file |
| confidence |
Identifies the confidence that the creator has in the correctness of their da… |
| configuration_version |
The version of the analysis product configuration that was used to perform th… |
| contact_information |
The contact information (e-mail, phone number, etc |
| contains_refs |
References to other cyber-observable objects that this one contains |
| content |
The content of the note |
| content_disposition |
Specifies the value of the ‘Content-Disposition’ header field of the MIME par… |
| content_ref |
Specifies the content of the file, represented as an Artifact Object |
| content_type |
The value of a Content-Type header field |
| contents |
Contains the actual Language Content (translation) |
| context |
A short description of the particular context shared by the content reference… |
| count |
This is an integer between 0 and 999,999,999 inclusive and represents the num… |
| country |
The country that this Location describes |
| cpe |
The Common Platform Enumeration (CPE) 2 |
| created |
The time at which the object, or its first version, was created |
| created_by_ref |
A reference to the identity of the object’s creator |
| created_time |
Specifies the date/time at which the process was created |
| creator_user_ref |
A reference to the user account that created the object |
| credential |
A cleartext credential, such as a hard-coded password that malware tries for … |
| credential_last_changed |
Specifies when the account credential was last changed |
| crl_distribution_points |
Specifies how CRL information is obtained |
| ctime |
The time at which the object was created |
| cwd |
Specifies the current working directory of the process |
| data |
Specifies the data contained in the registry value |
| data_type |
Specifies the registry (REG_*) data type used in the registry value |
| decryption_key |
Specifies the decryption key for the encrypted binary data (either via payloa… |
| defanged |
Defines whether or not the data contained within the object has been defanged |
| definition |
The marking itself: a statement, or a Traffic Light Protocol (TLP) level |
| definition_type |
The type of the marking definition, such as statement or tlp |
| dep_enabled |
Specifies whether Data Execution Prevention (DEP) is enabled for the process |
| description |
A description of the object, which may be long |
| descriptions |
Specifies the descriptions defined for the service |
| display_name |
A name for display |
| dll_characteristics_hex |
Specifies the flags that characterize the PE binary |
| document_info_dict |
Specifies details of the PDF document information dictionary (DID), which inc… |
| dst_byte_count |
Specifies the number of bytes sent from the destination to the source |
| dst_flags_hex |
Specifies the destination TCP flags, as the union of all TCP flags observed b… |
| dst_packets |
Specifies the number of packets sent destination to the source |
| dst_payload_ref |
Specifies the bytes sent from the source to the destination |
| dst_port |
The destination port of the traffic |
| dst_ref |
Specifies the destination of the network traffic, as a reference to an Observ… |
| email_date |
Specifies the date/time that the email message was sent |
| encapsulated_by_ref |
Links to another network-traffic object which encapsulates this object |
| encapsulates_refs |
Links to other network-traffic objects encapsulated by a network-traffic |
| encryption_algorithm |
If the artifact is encrypted, specifies the type of encryption algorithm the … |
| end |
Specifies the date/time the network traffic ended, if known |
| entropy |
Specifies the calculated entropy for the section, as calculated using the Sha… |
| environment_variables |
Specifies the list of environment variables associated with the process as a … |
| exif_tags |
Specifies the set of EXIF tags found in the image file, as a dictionary |
| explanation |
An explanation of why the producer has this Opinion |
| extended_key_usage |
Specifies a list of usages indicating purposes for which the certificate publ… |
| extension_properties |
The list of new property names that are added to an object by this extension |
| extension_type |
The kind of extension, as the extension’s definition declares it |
| extension_types |
Which extension types are contained within this extension |
| extensions |
The object’s extensions, as a dictionary keyed by extension name |
| external_id |
An identifier of the external content in its source, such as CVE-2016-1234 |
| external_references |
References to non-STIX information about the object |
| field |
The name of the part of an analytic that can be tuned |
| file_alignment |
Specifies the factor (in bytes) that is used to align the raw data of section… |
| file_header_hashes |
Specifies any hashes that were computed for the file header |
| first_observed |
The beginning of the time window that the data was observed during |
| first_seen |
The time at which the object was first seen |
| from_ref |
Specifies the value of the ‘From:’ header of the email message |
| gid |
Specifies the primary group ID of the account |
| goals |
The high-level goals |
| granular_markings |
The granular markings that apply to parts of the object |
| group_name |
Specifies the name of the load ordering group of which the service is a membe… |
| groups |
Specifies a list of names of groups that the account is a member of |
| hashes |
A dictionary of hashes of the content, keyed by hash algorithm |
| home_dir |
Specifies the home directory of the account |
| host_vm_ref |
A description of the virtual machine environment used to host the guest opera… |
| icmp_code_hex |
Specifies the ICMP code byte |
| icmp_type_hex |
Specifies the ICMP type byte |
| id |
The identifier of the object: its STIX type, two hyphens and a UUID |
| identity_class |
The kind of entity the identity describes, such as an individual or an organi… |
| image_base |
Specifies the preferred address of the first byte of the image when loaded in… |
| image_height |
Specifies the height of the image in the image file, in pixels |
| image_ref |
Specifies the executable binary that was executed as the process image, as a … |
| image_width |
Specifies the width of the image in the image file, in pixels |
| imphash |
Specifies the special import hash, or ‘imphash’, calculated for the PE Binary… |
| implementation_languages |
The programming languages used to write the malware instance or family |
| indicator_types |
The kinds of indicator, such as malicious-activity |
| infrastructure_types |
The kinds of infrastructure, such as botnet |
| inhibit_any_policy |
Specifies the number of additional certificates that may appear in the path b… |
| installed_software_refs |
Any non-standard software installed on the operating system used for the dyna… |
| integrity_level |
Specifies the Windows integrity level, or trustworthiness, of the process |
| ipfix |
Specifies any IP Flow Information Export (IPFIX) data for the traffic |
| is_active |
Indicates whether the network traffic is still ongoing |
| is_blocking |
Specifies whether the socket is in blocking mode |
| is_disabled |
Specifies if the account is disabled |
| is_family |
Whether the object represents a malware family (if true) or a malware instanc… |
| is_hidden |
Specifies whether the process is hidden |
| is_listening |
Specifies whether the socket is in listening mode |
| is_multipart |
Indicates whether the email body contains multiple MIME parts |
| is_optimized |
Specifies whether the PDF file has been optimized |
| is_privileged |
Specifies that the account has elevated privileges (i |
| is_self_signed |
Specifies whether the certificate is self-signed, i |
| is_service_account |
Indicates that the account is associated with a network service or system pro… |
| issuer |
Specifies the name of the Certificate Authority that issued the certificate |
| issuer_alternative_name |
Specifies the additional identities to be bound to the issuer of the certific… |
| key |
Specifies the full registry key including the hive |
| key_usage |
Specifies a multi-valued extension consisting of a list of names of the permi… |
| kill_chain_name |
The name of the kill chain |
| kill_chain_phases |
The kill chain phases to which the object corresponds |
| labels |
The labels property specifies a set of terms used to describe this object |
| lang |
The language of the text content, as an RFC 5646 language code |
| languages |
The languages the software supports, as RFC 5646 language codes |
| last_observed |
The end of the time window that the data was observed during |
| last_seen |
The time at which the object was last seen |
| latitude |
The latitude of the Location in decimal degrees |
| loader_flags_hex |
Specifies the reserved loader flags |
| longitude |
The longitude of the Location in decimal degrees |
| machine_hex |
Specifies the type of target machine |
| magic_hex |
Specifies the unsigned integer that indicates the type of the PE binary |
| magic_number_hex |
Specifies the hexadecimal constant (‘magic number’) associated with a specifi… |
| major_image_version |
Specifies the major version number of the image |
| major_linker_version |
Specifies the linker major version number |
| major_os_version |
Specifies the major version number of the required operating system |
| major_subsystem_version |
Specifies the major version number of the subsystem |
| malware_types |
The kinds of malware, such as ransomware |
| marking_ref |
The marking_ref property specifies the ID of the marking-definition object th… |
| message_body_data_ref |
Specifies the data contained in the HTTP message body, if included |
| message_body_length |
Specifies the length of the HTTP message body, if included, in bytes |
| message_id |
Specifies the Message-ID field of the email message |
| mime_type |
The MIME type of the content, as the IANA Media Types registry names it |
| minor_image_version |
Specifies the minor version number of the image |
| minor_linker_version |
Specifies the linker minor version number |
| minor_os_version |
Specifies the minor version number of the required operating system |
| minor_subsystem_version |
Specifies the minor version number of the subsystem |
| modified |
The time at which this version of the object was modified |
| modified_time |
Specifies the last date/time that the registry key was modified |
| modules |
The particular analysis product modules that were used to perform the analysi… |
| mtime |
The time at which the object was last written to |
| name |
A name that identifies the object |
| name_constraints |
Specifies a namespace within which all subject names in subsequent certificat… |
| name_enc |
Specifies the observed encoding for the name of the file |
| number |
Specifies the number assigned to the AS |
| number_observed |
The number of times the data in objects or object_refs was observed |
| number_of_rva_and_sizes |
Specifies the number of data-directory entries in the remainder of the option… |
| number_of_sections |
Specifies the number of sections in the PE binary, as a non-negative integer |
| number_of_subkeys |
Specifies the number of subkeys contained under the registry key |
| number_of_symbols |
Specifies the number of entries in the symbol table of the PE binary, as a no… |
| object_marking_refs |
References to the marking definitions that apply to the object |
| object_modified |
Identifies the modified time of the object that this Language Content applies… |
| object_ref |
Identifies the object that this Language Content applies to |
| object_refs |
References to the STIX objects that this object is about or holds |
| objective |
The campaign’s primary goal, objective, desired outcome or intended effect |
| objects |
Objects that this object holds: a list in a bundle, a dictionary in observed … |
| observed_data_refs |
A list of ID references to the Observed Data objects that contain the raw cyb… |
| opened_connection_refs |
Specifies the list of network connections opened by the process, as a referen… |
| operating_system_ref |
The operating system that was used to perform the dynamic analysis |
| operating_system_refs |
The operating systems that the malware family or malware instance is executab… |
| opinion |
The producer’s opinion of the objects that object_refs lists |
| optional_header |
Specifies the PE optional header of the PE binary |
| options |
Specifies any options (SO_*) that may be used by the socket, as a dictionary |
| owner_sid |
Specifies the Security ID (SID) value of the owner of the process |
| parent_directory_ref |
Specifies the parent directory of the file, as a reference to a Directory Obj… |
| parent_ref |
Specifies the other process that spawned (i |
| path |
A path, as it was observed |
| path_enc |
Specifies the observed encoding for the path |
| pattern |
The detection pattern for this indicator |
| pattern_type |
The type of pattern used in this indicator |
| pattern_version |
The version of the pattern that is used |
| payload_bin |
Specifies the binary data contained in the artifact as a base64-encoded strin… |
| pdfid0 |
Specifies the first file identifier found for the PDF file |
| pdfid1 |
Specifies the second file identifier found for the PDF file |
| pe_type |
The type of the PE binary, such as exe or dll |
| personal_motivations |
The threat actor’s personal reasons or motivations, apart from its organizati… |
| phase_name |
The name of the phase in the kill chain |
| pid |
Specifies the Process ID, or PID, of the process |
| pointer_to_symbol_table_hex |
Specifies the file offset of the COFF symbol table |
| policy_constraints |
Specifies any constraints on path validation for certificates issued to CAs |
| policy_mappings |
Specifies one or more pairs of OIDs; each pair includes an issuerDomainPolicy… |
| postal_code |
The postal code for this Location |
| precision |
Defines the precision of the coordinates specified by the latitude and longit… |
| primary_motivation |
The primary reason, motivation or purpose behind the activity |
| priority |
Specifies the current priority class of the process in Windows |
| private_key_usage_period_not_after |
Specifies the date on which the validity period ends for the private key, if … |
| private_key_usage_period_not_before |
Specifies the date on which the validity period begins for the private key, i… |
| product |
The name of the analysis engine or product that was used for this analysis |
| protocols |
Specifies the protocols observed in the network traffic, along with their cor… |
| published |
The date that this report object was officially published by the creator of t… |
| raw_email_ref |
Specifies the raw binary contents of the email message, including both the he… |
| received_lines |
Specifies one or more Received header fields that may be included in the emai… |
| region |
The region that this Location describes |
| related_asset_sectors |
The sectors that use the related asset’s name |
| relationship_type |
The name used to identify the type of relationship |
| report_types |
The primary subjects of the report, such as threat-actor |
| request_header |
Specifies all of the HTTP header fields that may be found in the HTTP client … |
| request_method |
Specifies the HTTP method portion of the HTTP request line, as a lowercase st… |
| request_value |
Specifies the value (typically a resource path) portion of the HTTP request l… |
| request_version |
Specifies the HTTP version portion of the HTTP request line, as a lowercase s… |
| resolves_to_refs |
References to the cyber-observable objects that this one resolves to |
| resource_level |
The organizational level at which the actor typically works |
| result |
The classification result as determined by the scanner or tool analysis proce… |
| result_name |
The classification result or name assigned to the malware instance by the sca… |
| revoked |
The revoked property indicates whether the object has been revoked |
| rir |
Specifies the name of the Regional Internet Registry (RIR) that assigned the … |
| roles |
The roles that the identity or threat actor plays |
| sample_ref |
Refers to the object this analysis was performed against |
| sample_refs |
The sample_refs property specifies a list of identifiers of the SCO file or a… |
| schema |
The normative definition of the extension, either as a URL or as plain text e… |
| secondary_motivations |
The secondary reasons, motivations or purposes behind the activity |
| section_alignment |
Specifies the alignment (in bytes) of PE sections when they are loaded into m… |
| sections |
Specifies metadata about the sections in the PE file |
| sectors |
The industry sectors that the identity belongs to |
| selectors |
A list of selectors for content contained within the STIX object in which thi… |
| sender_ref |
Specifies the value of the ‘From’ field of the email message |
| serial_number |
Specifies the unique identifier for the certificate, as issued by a specific … |
| service_dll_refs |
Specifies the DLLs loaded by the service, as a reference to one or more File … |
| service_name |
Specifies the name of the service |
| service_status |
Specifies the current status of the service |
| service_type |
Specifies the type of the service |
| shell |
Specifies the account’s command shell |
| sid |
Specifies the security ID (SID) value assigned to the file |
| sighting_of_ref |
A reference to the domain object that was sighted |
| signature_algorithm |
Specifies the name of the algorithm used to sign the certificate |
| size |
A size in bytes, as a non-negative integer |
| size_of_code |
Specifies the size of the code (text) section |
| size_of_headers |
Specifies the combined size of the MS-DOS, PE header, and section headers, ro… |
| size_of_heap_commit |
Specifies the size of the local heap space to commit |
| size_of_heap_reserve |
Specifies the size of the local heap space to reserve |
| size_of_image |
Specifies the size, in bytes, of the image, including all headers, as the ima… |
| size_of_initialized_data |
Specifies the size of the initialized data section |
| size_of_optional_header |
Specifies the size of the optional header of the PE binary |
| size_of_stack_commit |
Specifies the size of the stack to commit |
| size_of_stack_reserve |
Specifies the size of the stack to reserve |
| size_of_uninitialized_data |
Specifies the size of the uninitialized data section |
| socket_descriptor |
Specifies the socket file descriptor value associated with the socket, as a n… |
| socket_handle |
Specifies the handle or inode value associated with the socket |
| socket_type |
Specifies the type of the socket |
| sophistication |
The skill, knowledge, training or expertise the threat actor needs to carry o… |
| source_name |
The source, such as a system, registry or organization, that defines the refe… |
| source_ref |
The ID of the source (from) object |
| spec_version |
The version of the STIX specification used to represent the object |
| src_byte_count |
Specifies the number of bytes sent from the source to the destination |
| src_flags_hex |
Specifies the source TCP flags, as the union of all TCP flags observed betwee… |
| src_packets |
Specifies the number of packets sent from the source to the destination |
| src_payload_ref |
Specifies the bytes sent from the source to the destination |
| src_port |
The source port of the traffic |
| src_ref |
Specifies the source of the network traffic, as a reference to an Observable … |
| start |
Specifies the date/time the network traffic was initiated, if known |
| start_time |
This optional timestamp represents the earliest time at which the Relationshi… |
| start_type |
Specifies the start options defined for the service |
| startup_info |
Specifies the STARTUP_INFO struct used by the process, as a dictionary |
| statement |
A statement, such as a copyright or terms of use, that applies to the marked … |
| stop_time |
The latest time at which the Relationship between the objects exists |
| street_address |
The street address that this Location describes |
| subject |
A subject, as a string; each class says of what |
| subject_alternative_name |
Specifies the additional identities to be bound to the subject of the certifi… |
| subject_directory_attributes |
The identification attributes of the subject, such as nationality |
| subject_key_identifier |
Specifies the identifier that provides a means of identifying certificates th… |
| subject_public_key_algorithm |
Specifies the name of the algorithm with which to encrypt data being sent to … |
| subject_public_key_exponent |
Specifies the exponent portion of the subject’s public RSA key, as an integer |
| subject_public_key_modulus |
Specifies the modulus portion of the subject’s public RSA key |
| submitted |
The date and time that this malware was first submitted for scanning or analy… |
| subsystem_hex |
The subsystem, such as a GUI or a device driver, needed to run the image |
| summary |
The summary property indicates whether the Sighting should be considered summ… |
| swid |
Specifies the Software Identification (SWID) Tags entry for the software, if … |
| tactic_refs |
The tactics of the matrix, in the order the matrix shows them |
| target_ref |
The ID of the target (to) object |
| threat_actor_types |
The kinds of threat actor, such as nation-state |
| time_date_stamp |
The time at which the PE binary was created |
| tlp |
The Traffic Light Protocol level |
| to_refs |
Specifies the mailboxes that are ‘To:’ recipients of the email message |
| tool_types |
The kinds of tool, such as remote-access |
| tool_version |
The version identifier associated with the tool |
| type |
The STIX type name of the object, such as attack-pattern |
| url |
A URL |
| user_id |
Specifies the identifier of the account |
| valid_from |
The time from which this indicator should be considered valuable intelligence |
| valid_until |
The time at which this indicator should no longer be considered valuable inte… |
| validity_not_after |
Specifies the date on which the certificate validity period ends |
| validity_not_before |
Specifies the date on which the certificate validity period begins |
| value |
The value of the observable, in the form each class states |
| values |
Specifies the values found under the registry key |
| vendor |
Specifies the name of the vendor of the software |
| version |
A version, as a string; each class says of what |
| where_sighted_refs |
A list of ID references to the Identity or Location objects describing the en… |
| win32_version_value_hex |
Specifies the reserved win32 version value |
| window_title |
Specifies the title of the main window of the process |
| x509_v3_extensions |
Specifies any standard X |
| x_mitre_aliases |
Other names of a piece of software |
| x_mitre_analytic_refs |
The analytics that carry out the detection strategy, each named once |
| x_mitre_attack_spec_version |
The version of the ATT&CK specification the object follows, as MAJOR |
| x_mitre_collection_layers |
Where the data source’s data can be collected |
| x_mitre_contents |
The objects the collection holds, each at one version |
| x_mitre_contributors |
The people and organizations who contributed to the object |
| x_mitre_data_component_ref |
The data component whose log the reference names |
| x_mitre_data_source_ref |
The data source the data component belongs to |
| x_mitre_data_sources |
The data that can reveal the technique, each as “Data Source Name: Data Compo… |
| x_mitre_defense_bypassed |
The defenses a defense-evasion technique can get past |
| x_mitre_deprecated |
Whether ATT&CK has deprecated the object |
| x_mitre_detection |
How to tell that the technique has been used |
| x_mitre_domains |
The ATT&CK domains the object belongs to |
| x_mitre_effective_permissions |
The level of permission a privilege-escalation technique gains |
| x_mitre_first_seen_citation |
The sources for when the campaign was first seen, each written “(Citation: na… |
| x_mitre_impact_type |
Whether an impact technique attacks integrity, availability or both |
| x_mitre_is_subtechnique |
Whether the technique is a sub-technique of another |
| x_mitre_last_seen_citation |
The sources for when the campaign was last seen, written as x_mitre_first_see… |
| x_mitre_log_source_references |
The logs the analytic reads, each a data component with a log and channel of … |
| x_mitre_log_sources |
The logs that hold the data component’s data, each a pair of log and channel … |
| x_mitre_modified_by_ref |
The identity that made the current version of the object: always The MITRE Co… |
| x_mitre_mutable_elements |
The parts of the analytic a defender may tune to their environment, such as a… |
| x_mitre_network_requirements |
Whether the technique needs a network to run |
| x_mitre_old_attack_id |
An ATT&CK ID the object had before Mobile ATT&CK’s objects were renumbered, s… |
| x_mitre_permissions_required |
The lowest level of permission a privilege-escalation technique needs on a sy… |
| x_mitre_platforms |
The platforms the object applies to, each named once |
| x_mitre_related_assets |
The names a sector gives to devices like the asset, each with how it relates … |
| x_mitre_remote_support |
Whether an execution technique can run something on a remote system |
| x_mitre_sectors |
The industry sectors in which the asset is commonly found |
| x_mitre_shortname |
The tactic’s short name, which a technique’s kill chain phase uses as its pha… |
| x_mitre_system_requirements |
What the system must have or be, such as software or a patch level, for the t… |
| x_mitre_tactic_type |
Whether a Mobile technique needs access to the device |
| x_mitre_version |
The version of the object’s content, as MAJOR |
