Class: AttackCampaign

A campaign: intrusion activity over a stated period against common targets, with the sources for when it was first and last seen. Its ATT&CK ID is C and four digits.

URI: attack:AttackCampaign

 classDiagram
    class AttackCampaign
    click AttackCampaign href "../AttackCampaign/"
      StixCampaign <|-- AttackCampaign
        click StixCampaign href "../StixCampaign/"
      
      AttackCampaign : aliases
        
      AttackCampaign : confidence
        
      AttackCampaign : created
        
      AttackCampaign : created_by_ref
        
          
    
        
        
        AttackCampaign --> "1" StixIdentity : created_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      AttackCampaign : description
        
      AttackCampaign : extensions
        
          
    
        
        
        AttackCampaign --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      AttackCampaign : external_references
        
          
    
        
        
        AttackCampaign --> "1..*" StixExternalReference : external_references
        click StixExternalReference href "../StixExternalReference/"
    

        
      AttackCampaign : first_seen
        
      AttackCampaign : granular_markings
        
          
    
        
        
        AttackCampaign --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      AttackCampaign : id
        
      AttackCampaign : labels
        
      AttackCampaign : lang
        
      AttackCampaign : last_seen
        
      AttackCampaign : modified
        
      AttackCampaign : name
        
      AttackCampaign : object_marking_refs
        
          
    
        
        
        AttackCampaign --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      AttackCampaign : objective
        
      AttackCampaign : revoked
        
      AttackCampaign : spec_version
        
          
    
        
        
        AttackCampaign --> "1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      AttackCampaign : type
        
      AttackCampaign : x_mitre_attack_spec_version
        
      AttackCampaign : x_mitre_contributors
        
      AttackCampaign : x_mitre_deprecated
        
      AttackCampaign : x_mitre_domains
        
          
    
        
        
        AttackCampaign --> "1..*" AttackDomain : x_mitre_domains
        click AttackDomain href "../AttackDomain/"
    

        
      AttackCampaign : x_mitre_first_seen_citation
        
      AttackCampaign : x_mitre_last_seen_citation
        
      AttackCampaign : x_mitre_modified_by_ref
        
          
    
        
        
        AttackCampaign --> "1" StixIdentity : x_mitre_modified_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      AttackCampaign : x_mitre_old_attack_id
        
      AttackCampaign : x_mitre_version
        
      

Inheritance

• StixObject
  • StixCommonObject
    • StixDomainObject
      • StixCampaign
        • AttackCampaign

Slots

Name	Cardinality and Range	Description	Inheritance
x_mitre_attack_spec_version	1 String	The version of the ATT&CK specification the object follows, as MAJOR	direct
x_mitre_version	1 String	The version of the object’s content, as MAJOR	direct
x_mitre_deprecated	0..1 Boolean	Whether ATT&CK has deprecated the object	direct
x_mitre_old_attack_id	0..1 String	An ATT&CK ID the object had before Mobile ATT&CK’s objects were renumbered, s…	direct
x_mitre_domains	1..* AttackDomain	The ATT&CK domains the object belongs to	direct
x_mitre_modified_by_ref	1 StixIdentity	The identity that made the current version of the object: always The MITRE Co…	direct
x_mitre_contributors	1..* String	The people and organizations who contributed to the object	direct
x_mitre_first_seen_citation	1 String	The sources for when the campaign was first seen, each written “(Citation: na…	direct
x_mitre_last_seen_citation	1 String	The sources for when the campaign was last seen, written as x_mitre_first_see…	direct
name	1 String	A name that identifies the object	StixCampaign
description	1 String	A description of the object, which may be long	StixCampaign
aliases	1..* String	Other names by which the object is known	StixCampaign
first_seen	1 StixTimestamp	The time at which the object was first seen	StixCampaign
last_seen	1 StixTimestamp	The time at which the object was last seen	StixCampaign
objective	0..1 String	The campaign’s primary goal, objective, desired outcome or intended effect	StixCampaign
created_by_ref	1 StixIdentity	A reference to the identity of the object’s creator	StixCommonObject
created	1 StixTimestampMillis	The time at which the object, or its first version, was created	StixCommonObject
modified	1 StixTimestampMillis	The time at which this version of the object was modified	StixCommonObject
revoked	1 Boolean	The revoked property indicates whether the object has been revoked	StixCommonObject
labels	1..* String	The labels property specifies a set of terms used to describe this object	StixCommonObject
confidence	0..1 Integer	Identifies the confidence that the creator has in the correctness of their da…	StixCommonObject
lang	0..1 String	The language of the text content, as an RFC 5646 language code	StixCommonObject
external_references	1..* StixExternalReference	References to non-STIX information about the object	StixCommonObject
id	1 StixIdentifier	The identifier of the object: its STIX type, two hyphens and a UUID	StixObject
type	1 String	The STIX type name of the object, such as attack-pattern	StixObject
spec_version	1 StixSpecVersion	The version of the STIX specification used to represent the object	StixObject
object_marking_refs	1..* StixMarkingDefinition	References to the marking definitions that apply to the object	StixObject
granular_markings	1..* StixGranularMarking	The granular markings that apply to parts of the object	StixObject
extensions	0..1 StixExtensions	The object’s extensions, as a dictionary keyed by extension name	StixObject

Identifier and Mapping Information

Annotations

property	value
stix_type	campaign
attack_id_pattern	^C\d{4}$

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:AttackCampaign
native	attack:AttackCampaign

LinkML Source

Direct

name: AttackCampaign
annotations:
  stix_type:
    tag: stix_type
    value: campaign
  attack_id_pattern:
    tag: attack_id_pattern
    value: ^C\d{4}$
description: 'A campaign: intrusion activity over a stated period against common targets,
  with the sources for when it was first and last seen. Its ATT&CK ID is C and four
  digits.'
from_schema: https://w3id.org/lmodel/attack
is_a: StixCampaign
slots:
- x_mitre_attack_spec_version
- x_mitre_version
- x_mitre_deprecated
- x_mitre_old_attack_id
- x_mitre_domains
- x_mitre_modified_by_ref
- x_mitre_contributors
- x_mitre_first_seen_citation
- x_mitre_last_seen_citation
slot_usage:
  description:
    name: description
    required: true
  created_by_ref:
    name: created_by_ref
    required: true
  object_marking_refs:
    name: object_marking_refs
    required: true
  revoked:
    name: revoked
    required: true
  external_references:
    name: external_references
    required: true
  aliases:
    name: aliases
    required: true
  first_seen:
    name: first_seen
    required: true
  last_seen:
    name: last_seen
    required: true
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    required: true
  x_mitre_version:
    name: x_mitre_version
    required: true
  x_mitre_domains:
    name: x_mitre_domains
    required: true
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    required: true
  x_mitre_first_seen_citation:
    name: x_mitre_first_seen_citation
    required: true
  x_mitre_last_seen_citation:
    name: x_mitre_last_seen_citation
    required: true

Induced

name: AttackCampaign
annotations:
  stix_type:
    tag: stix_type
    value: campaign
  attack_id_pattern:
    tag: attack_id_pattern
    value: ^C\d{4}$
description: 'A campaign: intrusion activity over a stated period against common targets,
  with the sources for when it was first and last seen. Its ATT&CK ID is C and four
  digits.'
from_schema: https://w3id.org/lmodel/attack
is_a: StixCampaign
slot_usage:
  description:
    name: description
    required: true
  created_by_ref:
    name: created_by_ref
    required: true
  object_marking_refs:
    name: object_marking_refs
    required: true
  revoked:
    name: revoked
    required: true
  external_references:
    name: external_references
    required: true
  aliases:
    name: aliases
    required: true
  first_seen:
    name: first_seen
    required: true
  last_seen:
    name: last_seen
    required: true
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    required: true
  x_mitre_version:
    name: x_mitre_version
    required: true
  x_mitre_domains:
    name: x_mitre_domains
    required: true
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    required: true
  x_mitre_first_seen_citation:
    name: x_mitre_first_seen_citation
    required: true
  x_mitre_last_seen_citation:
    name: x_mitre_last_seen_citation
    required: true
attributes:
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    description: The version of the ATT&CK specification the object follows, as MAJOR.MINOR.PATCH.
      Without it, an object is read as version 2.0.0.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_attack_spec_version
    owner: AttackCampaign
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    - AttackIdentity
    range: string
    required: true
    pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$
  x_mitre_version:
    name: x_mitre_version
    description: The version of the object's content, as MAJOR.MINOR with each number
      between 0 and 99. ATT&CK raises it when the content changes.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_version
    owner: AttackCampaign
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    range: string
    required: true
    pattern: ^\d{1,2}\.\d{1,2}$
  x_mitre_deprecated:
    name: x_mitre_deprecated
    description: Whether ATT&CK has deprecated the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_deprecated
    owner: AttackCampaign
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    - AttackIdentity
    range: boolean
  x_mitre_old_attack_id:
    name: x_mitre_old_attack_id
    description: An ATT&CK ID the object had before Mobile ATT&CK's objects were renumbered,
      such as MOB-S0012.
    deprecated: The ADM v4.11.7 marks it as deprecated, a legacy of the Mobile IDs
      that current ATT&CK IDs replaced, and names no release that removes it.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_old_attack_id
    owner: AttackCampaign
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    - AttackIdentity
    range: string
    pattern: ^MOB-(M|S)\d{4}$
  x_mitre_domains:
    name: x_mitre_domains
    description: The ATT&CK domains the object belongs to.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_domains
    owner: AttackCampaign
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    range: AttackDomain
    required: true
    multivalued: true
    minimum_cardinality: 1
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    description: 'The identity that made the current version of the object: always
      The MITRE Corporation''s. Earlier versions may have had other authors.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_modified_by_ref
    owner: AttackCampaign
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    range: StixIdentity
    required: true
    pattern: ^identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5$
  x_mitre_contributors:
    name: x_mitre_contributors
    description: The people and organizations who contributed to the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_contributors
    owner: AttackCampaign
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackAsset
    - AttackDataSource
    - AttackDetectionStrategy
    range: string
    multivalued: true
    pattern: \S
    minimum_cardinality: 1
  x_mitre_first_seen_citation:
    name: x_mitre_first_seen_citation
    description: 'The sources for when the campaign was first seen, each written "(Citation:
      name)" with no separator, where each name is the source name of one of the campaign''s
      external references.'
    comments:
    - As in the ADM, a name holds no colon and is not blank.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_first_seen_citation
    owner: AttackCampaign
    domain_of:
    - AttackCampaign
    range: string
    required: true
    pattern: '^(\(Citation: [^):]*[^):\s][^):]*\))+$'
  x_mitre_last_seen_citation:
    name: x_mitre_last_seen_citation
    description: The sources for when the campaign was last seen, written as x_mitre_first_seen_citation
      is.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_last_seen_citation
    owner: AttackCampaign
    domain_of:
    - AttackCampaign
    range: string
    required: true
    pattern: '^(\(Citation: [^):]*[^):\s][^):]*\))+$'
  name:
    name: name
    description: A name that identifies the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:name
    rank: 1000
    slot_uri: stix:name
    owner: AttackCampaign
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackLogSource
    - AttackLogSourceReference
    - StixIdentity
    - StixMarkingDefinition
    - StixExtensionDefinition
    - StixAutonomousSystem
    - StixFile
    - StixMutex
    - StixSoftware
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsRegistryValue
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    range: string
    required: true
  description:
    name: description
    description: A description of the object, which may be long.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:description
    rank: 1000
    slot_uri: stix:description
    owner: AttackCampaign
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackMutableElement
    - StixIdentity
    - StixExtensionDefinition
    - StixExternalReference
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    - StixRelationship
    - StixSighting
    range: string
    required: true
  aliases:
    name: aliases
    description: Other names by which the object is known.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:aliases
    owner: AttackCampaign
    domain_of:
    - StixAttackPattern
    - StixCampaign
    - StixInfrastructure
    - StixIntrusionSet
    - StixMalware
    - StixThreatActor
    - StixTool
    range: string
    required: true
    multivalued: true
    minimum_cardinality: 1
  first_seen:
    name: first_seen
    description: The time at which the object was first seen.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:first_seen
    owner: AttackCampaign
    domain_of:
    - StixCampaign
    - StixInfrastructure
    - StixIntrusionSet
    - StixMalware
    - StixThreatActor
    - StixSighting
    range: stix_timestamp
    required: true
  last_seen:
    name: last_seen
    description: The time at which the object was last seen.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:last_seen
    owner: AttackCampaign
    domain_of:
    - StixCampaign
    - StixInfrastructure
    - StixIntrusionSet
    - StixMalware
    - StixThreatActor
    - StixSighting
    range: stix_timestamp
    required: true
  objective:
    name: objective
    description: The campaign's primary goal, objective, desired outcome or intended
      effect.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:objective
    owner: AttackCampaign
    domain_of:
    - StixCampaign
    range: string
  created_by_ref:
    name: created_by_ref
    description: A reference to the identity of the object's creator.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:createdBy
    rank: 1000
    slot_uri: stix:created_by_ref
    owner: AttackCampaign
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixIdentity
    required: true
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    description: The time at which the object, or its first version, was created.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectCreatedTime
    rank: 1000
    slot_uri: stix:created
    owner: AttackCampaign
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: stix_timestamp_millis
    required: true
  modified:
    name: modified
    description: The time at which this version of the object was modified.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:modifiedTime
    rank: 1000
    slot_uri: stix:modified
    owner: AttackCampaign
    domain_of:
    - StixCommonObject
    range: stix_timestamp_millis
    required: true
  revoked:
    name: revoked
    description: The revoked property indicates whether the object has been revoked.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:revoked
    owner: AttackCampaign
    domain_of:
    - StixCommonObject
    range: boolean
    required: true
  labels:
    name: labels
    description: The labels property specifies a set of terms used to describe this
      object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:tag
    rank: 1000
    slot_uri: stix:labels
    owner: AttackCampaign
    domain_of:
    - StixCommonObject
    range: string
    multivalued: true
    minimum_cardinality: 1
  confidence:
    name: confidence
    description: Identifies the confidence that the creator has in the correctness
      of their data.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:confidence
    rank: 1000
    slot_uri: stix:confidence
    owner: AttackCampaign
    domain_of:
    - StixCommonObject
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: The language of the text content, as an RFC 5646 language code.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:lang
    owner: AttackCampaign
    domain_of:
    - StixCommonObject
    - StixGranularMarking
    range: string
  external_references:
    name: external_references
    description: References to non-STIX information about the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:externalReference
    rank: 1000
    slot_uri: stix:external_references
    owner: AttackCampaign
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixExternalReference
    required: true
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: AttackCampaign
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^campaign--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: AttackCampaign
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: campaign
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: AttackCampaign
    domain_of:
    - StixObject
    range: StixSpecVersion
    required: true
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: AttackCampaign
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    required: true
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: AttackCampaign
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: AttackCampaign
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true