Class: AttackMalware
Malware: commercial, custom or open-source software an adversary uses for malicious ends. ATT&CK counts it as software, with an ATT&CK ID of S and four digits, and gives its other names in x_mitre_aliases.
URI: attack:AttackMalware
classDiagram
class AttackMalware
click AttackMalware href "../AttackMalware/"
StixMalware <|-- AttackMalware
click StixMalware href "../StixMalware/"
AttackMalware : aliases
AttackMalware : architecture_execution_envs
AttackMalware : capabilities
AttackMalware : confidence
AttackMalware : created
AttackMalware : created_by_ref
AttackMalware --> "1" StixIdentity : created_by_ref
click StixIdentity href "../StixIdentity/"
AttackMalware : description
AttackMalware : extensions
AttackMalware --> "0..1" StixExtensions : extensions
click StixExtensions href "../StixExtensions/"
AttackMalware : external_references
AttackMalware --> "1..*" StixExternalReference : external_references
click StixExternalReference href "../StixExternalReference/"
AttackMalware : first_seen
AttackMalware : granular_markings
AttackMalware --> "1..*" StixGranularMarking : granular_markings
click StixGranularMarking href "../StixGranularMarking/"
AttackMalware : id
AttackMalware : implementation_languages
AttackMalware : is_family
AttackMalware : kill_chain_phases
AttackMalware --> "1..*" StixKillChainPhase : kill_chain_phases
click StixKillChainPhase href "../StixKillChainPhase/"
AttackMalware : labels
AttackMalware : lang
AttackMalware : last_seen
AttackMalware : malware_types
AttackMalware : modified
AttackMalware : name
AttackMalware : object_marking_refs
AttackMalware --> "1..*" StixMarkingDefinition : object_marking_refs
click StixMarkingDefinition href "../StixMarkingDefinition/"
AttackMalware : operating_system_refs
AttackMalware --> "1..*" StixSoftware : operating_system_refs
click StixSoftware href "../StixSoftware/"
AttackMalware : revoked
AttackMalware : sample_refs
AttackMalware --> "1..*" StixCyberObservableObject : sample_refs
click StixCyberObservableObject href "../StixCyberObservableObject/"
AttackMalware : spec_version
AttackMalware --> "1" StixSpecVersion : spec_version
click StixSpecVersion href "../StixSpecVersion/"
AttackMalware : type
AttackMalware : x_mitre_aliases
AttackMalware : x_mitre_attack_spec_version
AttackMalware : x_mitre_contributors
AttackMalware : x_mitre_deprecated
AttackMalware : x_mitre_domains
AttackMalware --> "1..*" AttackDomain : x_mitre_domains
click AttackDomain href "../AttackDomain/"
AttackMalware : x_mitre_modified_by_ref
AttackMalware --> "1" StixIdentity : x_mitre_modified_by_ref
click StixIdentity href "../StixIdentity/"
AttackMalware : x_mitre_old_attack_id
AttackMalware : x_mitre_platforms
AttackMalware --> "1..*" AttackPlatform : x_mitre_platforms
click AttackPlatform href "../AttackPlatform/"
AttackMalware : x_mitre_version
Inheritance
Section titled “Inheritance”- StixObject
- StixCommonObject
- StixDomainObject
- StixMalware
- AttackMalware
- StixMalware
- StixDomainObject
- StixCommonObject
| Name | Cardinality and Range | Description | Inheritance |
|---|---|---|---|
| x_mitre_attack_spec_version | 1 String |
The version of the ATT&CK specification the object follows, as MAJOR | direct |
| x_mitre_version | 1 String |
The version of the object’s content, as MAJOR | direct |
| x_mitre_deprecated | 0..1 Boolean |
Whether ATT&CK has deprecated the object | direct |
| x_mitre_old_attack_id | 0..1 String |
An ATT&CK ID the object had before Mobile ATT&CK’s objects were renumbered, s… | direct |
| x_mitre_domains | 1..* AttackDomain |
The ATT&CK domains the object belongs to | direct |
| x_mitre_modified_by_ref | 1 StixIdentity |
The identity that made the current version of the object: always The MITRE Co… | direct |
| x_mitre_contributors | 1..* String |
The people and organizations who contributed to the object | direct |
| x_mitre_platforms | 1..* AttackPlatform |
The platforms the object applies to, each named once | direct |
| x_mitre_aliases | 1..* String |
Other names of a piece of software | direct |
| aliases | 1..* String |
Other names by which the object is known | StixMalware |
| first_seen | 0..1 StixTimestamp |
The time at which the object was first seen | StixMalware |
| last_seen | 0..1 StixTimestamp |
The time at which the object was last seen | StixMalware |
| operating_system_refs | 1..* StixSoftware |
The operating systems that the malware family or malware instance is executab… | StixMalware |
| architecture_execution_envs | 1..* String or StixProcessorArchitecture |
The processor architectures, such as x86 or ARM, that the malware runs on | StixMalware |
| implementation_languages | 1..* String or StixImplementationLanguage |
The programming languages used to write the malware instance or family | StixMalware |
| capabilities | 1..* String or StixMalwareCapability |
The capabilities identified in the malware instance or family | StixMalware |
| sample_refs | 1..* StixCyberObservableObject or StixFile or StixArtifact |
The sample_refs property specifies a list of identifiers of the SCO file or a… | StixMalware |
| malware_types | 1..* String or StixMalwareType |
The kinds of malware, such as ransomware | StixMalware |
| name | 0..1 String |
A name that identifies the object | StixMalware |
| description | 1 String |
A description of the object, which may be long | StixMalware |
| kill_chain_phases | 1..* StixKillChainPhase |
The kill chain phases to which the object corresponds | StixMalware |
| is_family | 1 Boolean |
Whether the object represents a malware family (if true) or a malware instanc… | StixMalware |
| created_by_ref | 1 StixIdentity |
A reference to the identity of the object’s creator | StixCommonObject |
| created | 1 StixTimestampMillis |
The time at which the object, or its first version, was created | StixCommonObject |
| modified | 1 StixTimestampMillis |
The time at which this version of the object was modified | StixCommonObject |
| revoked | 0..1 Boolean |
The revoked property indicates whether the object has been revoked | StixCommonObject |
| labels | 1..* String |
The labels property specifies a set of terms used to describe this object | StixCommonObject |
| confidence | 0..1 Integer |
Identifies the confidence that the creator has in the correctness of their da… | StixCommonObject |
| lang | 0..1 String |
The language of the text content, as an RFC 5646 language code | StixCommonObject |
| external_references | 1..* StixExternalReference |
References to non-STIX information about the object | StixCommonObject |
| id | 1 StixIdentifier |
The identifier of the object: its STIX type, two hyphens and a UUID | StixObject |
| type | 1 String |
The STIX type name of the object, such as attack-pattern | StixObject |
| spec_version | 1 StixSpecVersion |
The version of the STIX specification used to represent the object | StixObject |
| object_marking_refs | 1..* StixMarkingDefinition |
References to the marking definitions that apply to the object | StixObject |
| granular_markings | 1..* StixGranularMarking |
The granular markings that apply to parts of the object | StixObject |
| extensions | 0..1 StixExtensions |
The object’s extensions, as a dictionary keyed by extension name | StixObject |
Identifier and Mapping Information
Section titled “Identifier and Mapping Information”Annotations
Section titled “Annotations”| property | value |
|---|---|
| stix_type | malware |
| attack_id_pattern | ^S\d{4}$ |
Schema Source
Section titled “Schema Source”- from schema: https://w3id.org/lmodel/attack
Mappings
Section titled “Mappings”| Mapping Type | Mapped Value |
|---|---|
| self | attack:AttackMalware |
| native | attack:AttackMalware |
LinkML Source
Section titled “LinkML Source”Direct
Section titled “Direct”name: AttackMalwareannotations: stix_type: tag: stix_type value: malware attack_id_pattern: tag: attack_id_pattern value: ^S\d{4}$description: 'Malware: commercial, custom or open-source software an adversary uses for malicious ends. ATT&CK counts it as software, with an ATT&CK ID of S and four digits, and gives its other names in x_mitre_aliases.'from_schema: https://w3id.org/lmodel/attackis_a: StixMalwareslots:- x_mitre_attack_spec_version- x_mitre_version- x_mitre_deprecated- x_mitre_old_attack_id- x_mitre_domains- x_mitre_modified_by_ref- x_mitre_contributors- x_mitre_platforms- x_mitre_aliasesslot_usage: created_by_ref: name: created_by_ref required: true description: name: description required: true external_references: name: external_references required: true x_mitre_attack_spec_version: name: x_mitre_attack_spec_version required: true x_mitre_version: name: x_mitre_version required: true x_mitre_domains: name: x_mitre_domains required: true x_mitre_modified_by_ref: name: x_mitre_modified_by_ref required: true x_mitre_old_attack_id: name: x_mitre_old_attack_id pattern: ^MOB-S\d{4}$Induced
Section titled “Induced”name: AttackMalwareannotations: stix_type: tag: stix_type value: malware attack_id_pattern: tag: attack_id_pattern value: ^S\d{4}$description: 'Malware: commercial, custom or open-source software an adversary uses for malicious ends. ATT&CK counts it as software, with an ATT&CK ID of S and four digits, and gives its other names in x_mitre_aliases.'from_schema: https://w3id.org/lmodel/attackis_a: StixMalwareslot_usage: created_by_ref: name: created_by_ref required: true description: name: description required: true external_references: name: external_references required: true x_mitre_attack_spec_version: name: x_mitre_attack_spec_version required: true x_mitre_version: name: x_mitre_version required: true x_mitre_domains: name: x_mitre_domains required: true x_mitre_modified_by_ref: name: x_mitre_modified_by_ref required: true x_mitre_old_attack_id: name: x_mitre_old_attack_id pattern: ^MOB-S\d{4}$attributes: x_mitre_attack_spec_version: name: x_mitre_attack_spec_version description: The version of the ATT&CK specification the object follows, as MAJOR.MINOR.PATCH. Without it, an object is read as version 2.0.0. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_attack_spec_version owner: AttackMalware domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelationship - AttackIdentity range: string required: true pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$ x_mitre_version: name: x_mitre_version description: The version of the object's content, as MAJOR.MINOR with each number between 0 and 99. ATT&CK raises it when the content changes. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_version owner: AttackMalware domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic range: string required: true pattern: ^\d{1,2}\.\d{1,2}$ x_mitre_deprecated: name: x_mitre_deprecated description: Whether ATT&CK has deprecated the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_deprecated owner: AttackMalware domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelationship - AttackIdentity range: boolean x_mitre_old_attack_id: name: x_mitre_old_attack_id description: An ATT&CK ID the object had before Mobile ATT&CK's objects were renumbered, such as MOB-S0012. deprecated: The ADM v4.11.7 marks it as deprecated, a legacy of the Mobile IDs that current ATT&CK IDs replaced, and names no release that removes it. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_old_attack_id owner: AttackMalware domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelationship - AttackIdentity range: string pattern: ^MOB-S\d{4}$ x_mitre_domains: name: x_mitre_domains description: The ATT&CK domains the object belongs to. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_domains owner: AttackMalware domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic range: AttackDomain required: true multivalued: true minimum_cardinality: 1 x_mitre_modified_by_ref: name: x_mitre_modified_by_ref description: 'The identity that made the current version of the object: always The MITRE Corporation''s. Earlier versions may have had other authors.' from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_modified_by_ref owner: AttackMalware domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelationship range: StixIdentity required: true pattern: ^identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5$ x_mitre_contributors: name: x_mitre_contributors description: The people and organizations who contributed to the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_contributors owner: AttackMalware domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackAsset - AttackDataSource - AttackDetectionStrategy range: string multivalued: true pattern: \S minimum_cardinality: 1 x_mitre_platforms: name: x_mitre_platforms description: The platforms the object applies to, each named once. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_platforms owner: AttackMalware domain_of: - AttackTechnique - AttackMalware - AttackTool - AttackAsset - AttackDataSource - AttackAnalytic range: AttackPlatform multivalued: true minimum_cardinality: 1 x_mitre_aliases: name: x_mitre_aliases description: Other names of a piece of software. The first is the software's own name. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_aliases owner: AttackMalware domain_of: - AttackMalware - AttackTool range: string multivalued: true pattern: \S minimum_cardinality: 1 aliases: name: aliases description: Other names by which the object is known. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:aliases owner: AttackMalware domain_of: - StixAttackPattern - StixCampaign - StixInfrastructure - StixIntrusionSet - StixMalware - StixThreatActor - StixTool range: string multivalued: true minimum_cardinality: 1 first_seen: name: first_seen description: The time at which the object was first seen. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:first_seen owner: AttackMalware domain_of: - StixCampaign - StixInfrastructure - StixIntrusionSet - StixMalware - StixThreatActor - StixSighting range: stix_timestamp last_seen: name: last_seen description: The time at which the object was last seen. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:last_seen owner: AttackMalware domain_of: - StixCampaign - StixInfrastructure - StixIntrusionSet - StixMalware - StixThreatActor - StixSighting range: stix_timestamp operating_system_refs: name: operating_system_refs description: The operating systems that the malware family or malware instance is executable on. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:operating_system_refs owner: AttackMalware domain_of: - StixMalware range: StixSoftware multivalued: true pattern: ^software--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ minimum_cardinality: 1 architecture_execution_envs: name: architecture_execution_envs description: The processor architectures, such as x86 or ARM, that the malware runs on. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:architecture_execution_envs owner: AttackMalware domain_of: - StixMalware range: string multivalued: true minimum_cardinality: 1 any_of: - range: StixProcessorArchitecture - range: string implementation_languages: name: implementation_languages description: The programming languages used to write the malware instance or family. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:implementation_languages owner: AttackMalware domain_of: - StixMalware range: string multivalued: true minimum_cardinality: 1 any_of: - range: StixImplementationLanguage - range: string capabilities: name: capabilities description: The capabilities identified in the malware instance or family. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:capabilities owner: AttackMalware domain_of: - StixMalware range: string multivalued: true minimum_cardinality: 1 any_of: - range: StixMalwareCapability - range: string sample_refs: name: sample_refs description: The sample_refs property specifies a list of identifiers of the SCO file or artifact objects associated with this malware instance(s) or family. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:sample_refs owner: AttackMalware domain_of: - StixMalware range: StixCyberObservableObject multivalued: true pattern: ^(file|artifact)--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ minimum_cardinality: 1 any_of: - range: StixFile - range: StixArtifact malware_types: name: malware_types description: The kinds of malware, such as ransomware. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:malware_types owner: AttackMalware domain_of: - StixMalware range: string multivalued: true minimum_cardinality: 1 any_of: - range: StixMalwareType - range: string name: name: name description: A name that identifies the object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:name rank: 1000 slot_uri: stix:name owner: AttackMalware domain_of: - AttackTactic - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelatedAsset - AttackLogSource - AttackLogSourceReference - StixIdentity - StixMarkingDefinition - StixExtensionDefinition - StixAutonomousSystem - StixFile - StixMutex - StixSoftware - StixAlternateDataStream - StixWindowsPeSection - StixWindowsRegistryValue - StixAttackPattern - StixCampaign - StixCourseOfAction - StixGrouping - StixIncident - StixIndicator - StixInfrastructure - StixIntrusionSet - StixLocation - StixMalware - StixReport - StixThreatActor - StixTool - StixVulnerability range: string description: name: description description: A description of the object, which may be long. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:description rank: 1000 slot_uri: stix:description owner: AttackMalware domain_of: - AttackTactic - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackAnalytic - AttackRelatedAsset - AttackMutableElement - StixIdentity - StixExtensionDefinition - StixExternalReference - StixAttackPattern - StixCampaign - StixCourseOfAction - StixGrouping - StixIncident - StixIndicator - StixInfrastructure - StixIntrusionSet - StixLocation - StixMalware - StixReport - StixThreatActor - StixTool - StixVulnerability - StixRelationship - StixSighting range: string required: true kill_chain_phases: name: kill_chain_phases description: The kill chain phases to which the object corresponds. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:kill_chain_phases owner: AttackMalware domain_of: - StixAttackPattern - StixIndicator - StixInfrastructure - StixMalware - StixTool range: StixKillChainPhase multivalued: true inlined: true inlined_as_list: true minimum_cardinality: 1 is_family: name: is_family description: Whether the object represents a malware family (if true) or a malware instance (if false). from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:is_family owner: AttackMalware domain_of: - StixMalware range: boolean required: true created_by_ref: name: created_by_ref description: A reference to the identity of the object's creator. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:createdBy rank: 1000 slot_uri: stix:created_by_ref owner: AttackMalware domain_of: - StixCommonObject - StixMarkingDefinition range: StixIdentity required: true pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ created: name: created description: The time at which the object, or its first version, was created. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:objectCreatedTime rank: 1000 slot_uri: stix:created owner: AttackMalware domain_of: - StixCommonObject - StixMarkingDefinition range: stix_timestamp_millis required: true modified: name: modified description: The time at which this version of the object was modified. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:modifiedTime rank: 1000 slot_uri: stix:modified owner: AttackMalware domain_of: - StixCommonObject range: stix_timestamp_millis required: true revoked: name: revoked description: The revoked property indicates whether the object has been revoked. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:revoked owner: AttackMalware domain_of: - StixCommonObject range: boolean labels: name: labels description: The labels property specifies a set of terms used to describe this object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:tag rank: 1000 slot_uri: stix:labels owner: AttackMalware domain_of: - StixCommonObject range: string multivalued: true minimum_cardinality: 1 confidence: name: confidence description: Identifies the confidence that the creator has in the correctness of their data. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:confidence rank: 1000 slot_uri: stix:confidence owner: AttackMalware domain_of: - StixCommonObject range: integer minimum_value: 0 maximum_value: 100 lang: name: lang description: The language of the text content, as an RFC 5646 language code. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:lang owner: AttackMalware domain_of: - StixCommonObject - StixGranularMarking range: string external_references: name: external_references description: References to non-STIX information about the object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:externalReference rank: 1000 slot_uri: stix:external_references owner: AttackMalware domain_of: - StixCommonObject - StixMarkingDefinition range: StixExternalReference required: true multivalued: true inlined: true inlined_as_list: true minimum_cardinality: 1 id: name: id description: 'The identifier of the object: its STIX type, two hyphens and a UUID. Each class narrows the type.' from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:id identifier: true owner: AttackMalware domain_of: - StixObject - StixBundle range: stix_identifier required: true pattern: ^malware--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ type: name: type description: The STIX type name of the object, such as attack-pattern. Each class pins its own. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:type owner: AttackMalware domain_of: - StixObject - StixBundle range: string required: true pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$ equals_string: malware spec_version: name: spec_version description: The version of the STIX specification used to represent the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:spec_version owner: AttackMalware domain_of: - StixObject range: StixSpecVersion required: true object_marking_refs: name: object_marking_refs description: References to the marking definitions that apply to the object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:objectMarking rank: 1000 slot_uri: stix:object_marking_refs owner: AttackMalware domain_of: - StixObject range: StixMarkingDefinition multivalued: true pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ minimum_cardinality: 1 granular_markings: name: granular_markings description: The granular markings that apply to parts of the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:granular_markings owner: AttackMalware domain_of: - StixObject range: StixGranularMarking multivalued: true inlined: true inlined_as_list: true minimum_cardinality: 1 extensions: name: extensions description: The object's extensions, as a dictionary keyed by extension name. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:extensions owner: AttackMalware domain_of: - StixObject range: StixExtensions inlined: true