Skip to content
attack

Class: AttackRelationship

A relationship between two ATT&CK objects, of one of the seven types ATT&CK uses. Its rules say which types of object each type of relationship may join.

URI: attack:AttackRelationship

 classDiagram
    class AttackRelationship
    click AttackRelationship href "../AttackRelationship/"
      StixRelationship <|-- AttackRelationship
        click StixRelationship href "../StixRelationship/"
      
      AttackRelationship : confidence
        
      AttackRelationship : created
        
      AttackRelationship : created_by_ref
        
          
    
        
        
        AttackRelationship --> "0..1" StixIdentity : created_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      AttackRelationship : description
        
      AttackRelationship : extensions
        
          
    
        
        
        AttackRelationship --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      AttackRelationship : external_references
        
          
    
        
        
        AttackRelationship --> "1..*" StixExternalReference : external_references
        click StixExternalReference href "../StixExternalReference/"
    

        
      AttackRelationship : granular_markings
        
          
    
        
        
        AttackRelationship --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      AttackRelationship : id
        
      AttackRelationship : labels
        
      AttackRelationship : lang
        
      AttackRelationship : modified
        
      AttackRelationship : object_marking_refs
        
          
    
        
        
        AttackRelationship --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      AttackRelationship : relationship_type
        
          
    
        
        
        AttackRelationship --> "1" AttackRelationshipType : relationship_type
        click AttackRelationshipType href "../AttackRelationshipType/"
    

        
      AttackRelationship : revoked
        
      AttackRelationship : source_ref
        
          
    
        
        
        AttackRelationship --> "1" StixObject : source_ref
        click StixObject href "../StixObject/"
    

        
      AttackRelationship : spec_version
        
          
    
        
        
        AttackRelationship --> "1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      AttackRelationship : start_time
        
      AttackRelationship : stop_time
        
      AttackRelationship : target_ref
        
          
    
        
        
        AttackRelationship --> "1" StixObject : target_ref
        click StixObject href "../StixObject/"
    

        
      AttackRelationship : type
        
      AttackRelationship : x_mitre_attack_spec_version
        
      AttackRelationship : x_mitre_deprecated
        
      AttackRelationship : x_mitre_modified_by_ref
        
          
    
        
        
        AttackRelationship --> "1" StixIdentity : x_mitre_modified_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      AttackRelationship : x_mitre_old_attack_id

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
x_mitre_attack_spec_version 1
String		 The version of the ATT&CK specification the object follows, as MAJOR direct
x_mitre_deprecated 0..1
Boolean		 Whether ATT&CK has deprecated the object direct
x_mitre_old_attack_id 0..1
String		 An ATT&CK ID the object had before Mobile ATT&CK’s objects were renumbered, s… direct
x_mitre_modified_by_ref 1
StixIdentity		 The identity that made the current version of the object: always The MITRE Co… direct
relationship_type 1
AttackRelationshipType		 The name used to identify the type of relationship StixRelationship
description 0..1
String		 A description of the object, which may be long StixRelationship
source_ref 1
StixObject or 
StixDomainObject or 
StixCyberObservableObject		 The ID of the source (from) object StixRelationship
target_ref 1
StixObject or 
StixDomainObject or 
StixCyberObservableObject		 The ID of the target (to) object StixRelationship
start_time 0..1
StixTimestamp		 This optional timestamp represents the earliest time at which the Relationshi… StixRelationship
stop_time 0..1
StixTimestamp		 The latest time at which the Relationship between the objects exists StixRelationship
created_by_ref 0..1
StixIdentity		 A reference to the identity of the object’s creator StixCommonObject
created 1
StixTimestampMillis		 The time at which the object, or its first version, was created StixCommonObject
modified 1
StixTimestampMillis		 The time at which this version of the object was modified StixCommonObject
revoked 0..1
Boolean		 The revoked property indicates whether the object has been revoked StixCommonObject
labels 1..*
String		 The labels property specifies a set of terms used to describe this object StixCommonObject
confidence 0..1
Integer		 Identifies the confidence that the creator has in the correctness of their da… StixCommonObject
lang 0..1
String		 The language of the text content, as an RFC 5646 language code StixCommonObject
external_references 1..*
StixExternalReference		 References to non-STIX information about the object StixCommonObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject

Rules

Section titled “Rules”

Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'relationship_type': {'equals_string': 'uses'}} ```{‘source_ref’: {‘pattern’: ’^(intrusion-set campaign

Section titled “”
Rule Applied Preconditions Postconditions Elseconditions
slot_conditions ```{‘relationship_type’: {‘equals_string’: ‘uses’}, ‘source_ref’: {‘pattern’: ’^(malware tool)–’}}``` {'target_ref': {'pattern': '^attack-pattern--'}}

Section titled “”
Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'relationship_type': {'equals_string': 'mitigates'}} {'source_ref': {'pattern': '^course-of-action--'}, 'target_ref': {'pattern': '^attack-pattern--'}}

Section titled “”
Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'relationship_type': {'equals_string': 'subtechnique-of'}} {'source_ref': {'pattern': '^attack-pattern--'}, 'target_ref': {'pattern': '^attack-pattern--'}}

Section titled “”
Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'relationship_type': {'equals_string': 'detects'}} ```{‘source_ref’: {‘pattern’: ’^(x-mitre-detection-strategy x-mitre-data-component)–’}, ‘target_ref’: {‘pattern’: ‘^attack-pattern–’}}```

Section titled “”
Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'relationship_type': {'equals_string': 'attributed-to'}} {'source_ref': {'pattern': '^campaign--'}, 'target_ref': {'pattern': '^intrusion-set--'}}

Section titled “”
Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'relationship_type': {'equals_string': 'targets'}} {'source_ref': {'pattern': '^attack-pattern--'}, 'target_ref': {'pattern': '^x-mitre-asset--'}}

Section titled “”
Rule Applied Preconditions Postconditions Elseconditions
slot_conditions {'relationship_type': {'equals_string': 'revoked-by'}} ```{‘source_ref’: {‘pattern’: ’^(attack-pattern campaign

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type relationship

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:AttackRelationship
native attack:AttackRelationship

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: AttackRelationship
annotations:
  stix_type:
    tag: stix_type
    value: relationship
description: A relationship between two ATT&CK objects, of one of the seven types
  ATT&CK uses. Its rules say which types of object each type of relationship may join.
from_schema: https://w3id.org/lmodel/attack
is_a: StixRelationship
slots:
- x_mitre_attack_spec_version
- x_mitre_deprecated
- x_mitre_old_attack_id
- x_mitre_modified_by_ref
slot_usage:
  relationship_type:
    name: relationship_type
    range: AttackRelationshipType
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    required: true
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    required: true
rules:
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: uses
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^(intrusion-set|campaign|malware|tool)--
      target_ref:
        name: target_ref
        pattern: ^(attack-pattern|malware|tool)--
  description: A group, a campaign or software uses a technique or software.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: uses
      source_ref:
        name: source_ref
        pattern: ^(malware|tool)--
  postconditions:
    slot_conditions:
      target_ref:
        name: target_ref
        pattern: ^attack-pattern--
  description: Software uses techniques, not other software.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: mitigates
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^course-of-action--
      target_ref:
        name: target_ref
        pattern: ^attack-pattern--
  description: A mitigation mitigates a technique.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: subtechnique-of
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^attack-pattern--
      target_ref:
        name: target_ref
        pattern: ^attack-pattern--
  description: A sub-technique belongs to a technique.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: detects
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^(x-mitre-detection-strategy|x-mitre-data-component)--
      target_ref:
        name: target_ref
        pattern: ^attack-pattern--
  description: A detection strategy, or a data component as before detection strategies,
    detects a technique.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: attributed-to
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^campaign--
      target_ref:
        name: target_ref
        pattern: ^intrusion-set--
  description: A campaign is attributed to a group.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: targets
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^attack-pattern--
      target_ref:
        name: target_ref
        pattern: ^x-mitre-asset--
  description: A technique targets an asset.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: revoked-by
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^(attack-pattern|campaign|course-of-action|intrusion-set|malware|tool|x-mitre-asset|x-mitre-data-component)--
      target_ref:
        name: target_ref
        pattern: ^(attack-pattern|campaign|course-of-action|intrusion-set|malware|tool|x-mitre-asset|x-mitre-data-component)--
  description: An object that can be revoked is replaced by another such object.
  comments:
  - The ADM asks for one of the same type; the v20.0 data has a malware revoked by
    a tool, so the rule does not.

Induced

Section titled “Induced”
name: AttackRelationship
annotations:
  stix_type:
    tag: stix_type
    value: relationship
description: A relationship between two ATT&CK objects, of one of the seven types
  ATT&CK uses. Its rules say which types of object each type of relationship may join.
from_schema: https://w3id.org/lmodel/attack
is_a: StixRelationship
slot_usage:
  relationship_type:
    name: relationship_type
    range: AttackRelationshipType
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    required: true
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    required: true
attributes:
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    description: The version of the ATT&CK specification the object follows, as MAJOR.MINOR.PATCH.
      Without it, an object is read as version 2.0.0.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_attack_spec_version
    owner: AttackRelationship
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    - AttackIdentity
    range: string
    required: true
    pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$
  x_mitre_deprecated:
    name: x_mitre_deprecated
    description: Whether ATT&CK has deprecated the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_deprecated
    owner: AttackRelationship
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    - AttackIdentity
    range: boolean
  x_mitre_old_attack_id:
    name: x_mitre_old_attack_id
    description: An ATT&CK ID the object had before Mobile ATT&CK's objects were renumbered,
      such as MOB-S0012.
    deprecated: The ADM v4.11.7 marks it as deprecated, a legacy of the Mobile IDs
      that current ATT&CK IDs replaced, and names no release that removes it.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_old_attack_id
    owner: AttackRelationship
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    - AttackIdentity
    range: string
    pattern: ^MOB-(M|S)\d{4}$
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    description: 'The identity that made the current version of the object: always
      The MITRE Corporation''s. Earlier versions may have had other authors.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_modified_by_ref
    owner: AttackRelationship
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    range: StixIdentity
    required: true
    pattern: ^identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5$
  relationship_type:
    name: relationship_type
    description: The name used to identify the type of relationship.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:kindOfRelationship
    rank: 1000
    slot_uri: stix:relationship_type
    owner: AttackRelationship
    domain_of:
    - StixRelationship
    range: AttackRelationshipType
    required: true
    pattern: ^[a-z0-9\-]+$
  description:
    name: description
    description: A description of the object, which may be long.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:description
    rank: 1000
    slot_uri: stix:description
    owner: AttackRelationship
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackMutableElement
    - StixIdentity
    - StixExtensionDefinition
    - StixExternalReference
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    - StixRelationship
    - StixSighting
    range: string
  source_ref:
    name: source_ref
    description: The ID of the source (from) object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:source
    rank: 1000
    slot_uri: stix:source_ref
    owner: AttackRelationship
    domain_of:
    - StixRelationship
    range: StixObject
    required: true
    pattern: ^(?!(relationship|sighting|bundle|marking-definition|language-content)--)[a-z][a-z0-9-]+[a-z0-9]--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    any_of:
    - range: StixDomainObject
    - range: StixCyberObservableObject
  target_ref:
    name: target_ref
    description: The ID of the target (to) object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:target
    rank: 1000
    slot_uri: stix:target_ref
    owner: AttackRelationship
    domain_of:
    - StixRelationship
    range: StixObject
    required: true
    pattern: ^(?!(relationship|sighting|bundle|marking-definition|language-content)--)[a-z][a-z0-9-]+[a-z0-9]--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    any_of:
    - range: StixDomainObject
    - range: StixCyberObservableObject
  start_time:
    name: start_time
    description: This optional timestamp represents the earliest time at which the
      Relationship between the objects exists. If this property is a future timestamp,
      at the time the updated property is defined, then this represents an estimate
      by the producer of the intelligence of the earliest time at which relationship
      will be asserted to be true.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:startTime
    rank: 1000
    slot_uri: stix:start_time
    owner: AttackRelationship
    domain_of:
    - StixRelationship
    range: stix_timestamp
  stop_time:
    name: stop_time
    description: The latest time at which the Relationship between the objects exists.
      If this property is a future timestamp, at the time the updated property is
      defined, then this represents an estimate by the producer of the intelligence
      of the latest time at which relationship will be asserted to be true.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:endTime
    rank: 1000
    slot_uri: stix:stop_time
    owner: AttackRelationship
    domain_of:
    - StixRelationship
    range: stix_timestamp
  created_by_ref:
    name: created_by_ref
    description: A reference to the identity of the object's creator.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:createdBy
    rank: 1000
    slot_uri: stix:created_by_ref
    owner: AttackRelationship
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixIdentity
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    description: The time at which the object, or its first version, was created.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectCreatedTime
    rank: 1000
    slot_uri: stix:created
    owner: AttackRelationship
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: stix_timestamp_millis
    required: true
  modified:
    name: modified
    description: The time at which this version of the object was modified.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:modifiedTime
    rank: 1000
    slot_uri: stix:modified
    owner: AttackRelationship
    domain_of:
    - StixCommonObject
    range: stix_timestamp_millis
    required: true
  revoked:
    name: revoked
    description: The revoked property indicates whether the object has been revoked.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:revoked
    owner: AttackRelationship
    domain_of:
    - StixCommonObject
    range: boolean
  labels:
    name: labels
    description: The labels property specifies a set of terms used to describe this
      object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:tag
    rank: 1000
    slot_uri: stix:labels
    owner: AttackRelationship
    domain_of:
    - StixCommonObject
    range: string
    multivalued: true
    minimum_cardinality: 1
  confidence:
    name: confidence
    description: Identifies the confidence that the creator has in the correctness
      of their data.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:confidence
    rank: 1000
    slot_uri: stix:confidence
    owner: AttackRelationship
    domain_of:
    - StixCommonObject
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: The language of the text content, as an RFC 5646 language code.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:lang
    owner: AttackRelationship
    domain_of:
    - StixCommonObject
    - StixGranularMarking
    range: string
  external_references:
    name: external_references
    description: References to non-STIX information about the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:externalReference
    rank: 1000
    slot_uri: stix:external_references
    owner: AttackRelationship
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixExternalReference
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: AttackRelationship
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^relationship--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: AttackRelationship
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: relationship
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: AttackRelationship
    domain_of:
    - StixObject
    range: StixSpecVersion
    required: true
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: AttackRelationship
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: AttackRelationship
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: AttackRelationship
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true
rules:
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: uses
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^(intrusion-set|campaign|malware|tool)--
      target_ref:
        name: target_ref
        pattern: ^(attack-pattern|malware|tool)--
  description: A group, a campaign or software uses a technique or software.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: uses
      source_ref:
        name: source_ref
        pattern: ^(malware|tool)--
  postconditions:
    slot_conditions:
      target_ref:
        name: target_ref
        pattern: ^attack-pattern--
  description: Software uses techniques, not other software.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: mitigates
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^course-of-action--
      target_ref:
        name: target_ref
        pattern: ^attack-pattern--
  description: A mitigation mitigates a technique.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: subtechnique-of
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^attack-pattern--
      target_ref:
        name: target_ref
        pattern: ^attack-pattern--
  description: A sub-technique belongs to a technique.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: detects
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^(x-mitre-detection-strategy|x-mitre-data-component)--
      target_ref:
        name: target_ref
        pattern: ^attack-pattern--
  description: A detection strategy, or a data component as before detection strategies,
    detects a technique.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: attributed-to
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^campaign--
      target_ref:
        name: target_ref
        pattern: ^intrusion-set--
  description: A campaign is attributed to a group.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: targets
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^attack-pattern--
      target_ref:
        name: target_ref
        pattern: ^x-mitre-asset--
  description: A technique targets an asset.
- preconditions:
    slot_conditions:
      relationship_type:
        name: relationship_type
        equals_string: revoked-by
  postconditions:
    slot_conditions:
      source_ref:
        name: source_ref
        pattern: ^(attack-pattern|campaign|course-of-action|intrusion-set|malware|tool|x-mitre-asset|x-mitre-data-component)--
      target_ref:
        name: target_ref
        pattern: ^(attack-pattern|campaign|course-of-action|intrusion-set|malware|tool|x-mitre-asset|x-mitre-data-component)--
  description: An object that can be revoked is replaced by another such object.
  comments:
  - The ADM asks for one of the same type; the v20.0 data has a malware revoked by
    a tool, so the rule does not.