Skip to content
attack

Class: AttackTechnique

A technique: how an adversary achieves a tactic’s goal. Its ATT&CK ID is T and four digits, and a sub-technique’s adds a full stop and three digits.

URI: attack:AttackTechnique

 classDiagram
    class AttackTechnique
    click AttackTechnique href "../AttackTechnique/"
      StixAttackPattern <|-- AttackTechnique
        click StixAttackPattern href "../StixAttackPattern/"
      
      AttackTechnique : aliases
        
      AttackTechnique : confidence
        
      AttackTechnique : created
        
      AttackTechnique : created_by_ref
        
          
    
        
        
        AttackTechnique --> "0..1" StixIdentity : created_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      AttackTechnique : description
        
      AttackTechnique : extensions
        
          
    
        
        
        AttackTechnique --> "0..1" StixExtensions : extensions
        click StixExtensions href "../StixExtensions/"
    

        
      AttackTechnique : external_references
        
          
    
        
        
        AttackTechnique --> "1..*" StixExternalReference : external_references
        click StixExternalReference href "../StixExternalReference/"
    

        
      AttackTechnique : granular_markings
        
          
    
        
        
        AttackTechnique --> "1..*" StixGranularMarking : granular_markings
        click StixGranularMarking href "../StixGranularMarking/"
    

        
      AttackTechnique : id
        
      AttackTechnique : kill_chain_phases
        
          
    
        
        
        AttackTechnique --> "1..*" AttackKillChainPhase : kill_chain_phases
        click AttackKillChainPhase href "../AttackKillChainPhase/"
    

        
      AttackTechnique : labels
        
      AttackTechnique : lang
        
      AttackTechnique : modified
        
      AttackTechnique : name
        
      AttackTechnique : object_marking_refs
        
          
    
        
        
        AttackTechnique --> "1..*" StixMarkingDefinition : object_marking_refs
        click StixMarkingDefinition href "../StixMarkingDefinition/"
    

        
      AttackTechnique : revoked
        
      AttackTechnique : spec_version
        
          
    
        
        
        AttackTechnique --> "1" StixSpecVersion : spec_version
        click StixSpecVersion href "../StixSpecVersion/"
    

        
      AttackTechnique : type
        
      AttackTechnique : x_mitre_attack_spec_version
        
      AttackTechnique : x_mitre_contributors
        
      AttackTechnique : x_mitre_data_sources
        
      AttackTechnique : x_mitre_defense_bypassed
        
          
    
        
        
        AttackTechnique --> "1..*" AttackBypassedDefense : x_mitre_defense_bypassed
        click AttackBypassedDefense href "../AttackBypassedDefense/"
    

        
      AttackTechnique : x_mitre_deprecated
        
      AttackTechnique : x_mitre_detection
        
      AttackTechnique : x_mitre_domains
        
          
    
        
        
        AttackTechnique --> "1..*" AttackDomain : x_mitre_domains
        click AttackDomain href "../AttackDomain/"
    

        
      AttackTechnique : x_mitre_effective_permissions
        
          
    
        
        
        AttackTechnique --> "1..*" AttackEffectivePermission : x_mitre_effective_permissions
        click AttackEffectivePermission href "../AttackEffectivePermission/"
    

        
      AttackTechnique : x_mitre_impact_type
        
          
    
        
        
        AttackTechnique --> "1..*" AttackImpactType : x_mitre_impact_type
        click AttackImpactType href "../AttackImpactType/"
    

        
      AttackTechnique : x_mitre_is_subtechnique
        
      AttackTechnique : x_mitre_modified_by_ref
        
          
    
        
        
        AttackTechnique --> "0..1" StixIdentity : x_mitre_modified_by_ref
        click StixIdentity href "../StixIdentity/"
    

        
      AttackTechnique : x_mitre_network_requirements
        
      AttackTechnique : x_mitre_old_attack_id
        
      AttackTechnique : x_mitre_permissions_required
        
          
    
        
        
        AttackTechnique --> "1..*" AttackRequiredPermission : x_mitre_permissions_required
        click AttackRequiredPermission href "../AttackRequiredPermission/"
    

        
      AttackTechnique : x_mitre_platforms
        
          
    
        
        
        AttackTechnique --> "1..*" AttackPlatform : x_mitre_platforms
        click AttackPlatform href "../AttackPlatform/"
    

        
      AttackTechnique : x_mitre_remote_support
        
      AttackTechnique : x_mitre_system_requirements
        
      AttackTechnique : x_mitre_tactic_type
        
          
    
        
        
        AttackTechnique --> "1..*" AttackTacticType : x_mitre_tactic_type
        click AttackTacticType href "../AttackTacticType/"
    

        
      AttackTechnique : x_mitre_version

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
x_mitre_attack_spec_version 1
String		 The version of the ATT&CK specification the object follows, as MAJOR direct
x_mitre_version 1
String		 The version of the object’s content, as MAJOR direct
x_mitre_deprecated 0..1
Boolean		 Whether ATT&CK has deprecated the object direct
x_mitre_old_attack_id 0..1
String		 An ATT&CK ID the object had before Mobile ATT&CK’s objects were renumbered, s… direct
x_mitre_domains 1..*
AttackDomain		 The ATT&CK domains the object belongs to direct
x_mitre_modified_by_ref 0..1
StixIdentity		 The identity that made the current version of the object: always The MITRE Co… direct
x_mitre_contributors 1..*
String		 The people and organizations who contributed to the object direct
x_mitre_platforms 1..*
AttackPlatform		 The platforms the object applies to, each named once direct
x_mitre_is_subtechnique 1
Boolean		 Whether the technique is a sub-technique of another direct
x_mitre_impact_type 1..*
AttackImpactType		 Whether an impact technique attacks integrity, availability or both direct
x_mitre_network_requirements 0..1
Boolean		 Whether the technique needs a network to run direct
x_mitre_tactic_type 1..*
AttackTacticType		 Whether a Mobile technique needs access to the device direct
x_mitre_detection 0..1
String		 How to tell that the technique has been used direct
x_mitre_data_sources 1..*
String		 The data that can reveal the technique, each as “Data Source Name: Data Compo… direct
x_mitre_defense_bypassed 1..*
AttackBypassedDefense		 The defenses a defense-evasion technique can get past direct
x_mitre_permissions_required 1..*
AttackRequiredPermission		 The lowest level of permission a privilege-escalation technique needs on a sy… direct
x_mitre_effective_permissions 1..*
AttackEffectivePermission		 The level of permission a privilege-escalation technique gains direct
x_mitre_system_requirements 1..*
String		 What the system must have or be, such as software or a patch level, for the t… direct
x_mitre_remote_support 0..1
Boolean		 Whether an execution technique can run something on a remote system direct
aliases 1..*
String		 Other names by which the object is known StixAttackPattern
name 1
String		 A name that identifies the object StixAttackPattern
description 0..1
String		 A description of the object, which may be long StixAttackPattern
kill_chain_phases 1..*
AttackKillChainPhase		 The kill chain phases to which the object corresponds StixAttackPattern
created_by_ref 0..1
StixIdentity		 A reference to the identity of the object’s creator StixCommonObject
created 1
StixTimestampMillis		 The time at which the object, or its first version, was created StixCommonObject
modified 1
StixTimestampMillis		 The time at which this version of the object was modified StixCommonObject
revoked 0..1
Boolean		 The revoked property indicates whether the object has been revoked StixCommonObject
labels 1..*
String		 The labels property specifies a set of terms used to describe this object StixCommonObject
confidence 0..1
Integer		 Identifies the confidence that the creator has in the correctness of their da… StixCommonObject
lang 0..1
String		 The language of the text content, as an RFC 5646 language code StixCommonObject
external_references 1..*
StixExternalReference		 References to non-STIX information about the object StixCommonObject
id 1
StixIdentifier		 The identifier of the object: its STIX type, two hyphens and a UUID StixObject
type 1
String		 The STIX type name of the object, such as attack-pattern StixObject
spec_version 1
StixSpecVersion		 The version of the STIX specification used to represent the object StixObject
object_marking_refs 1..*
StixMarkingDefinition		 References to the marking definitions that apply to the object StixObject
granular_markings 1..*
StixGranularMarking		 The granular markings that apply to parts of the object StixObject
extensions 0..1
StixExtensions		 The object’s extensions, as a dictionary keyed by extension name StixObject

Comments

Section titled “Comments”
  • A sub-technique is a technique too, with x_mitre_is_subtechnique set and a subtechnique-of relationship to its parent.

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Annotations

Section titled “Annotations”
property value
stix_type attack-pattern
attack_id_pattern ^T\d{4}(.\d{3})?$

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self attack:AttackTechnique
native attack:AttackTechnique

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: AttackTechnique
annotations:
  stix_type:
    tag: stix_type
    value: attack-pattern
  attack_id_pattern:
    tag: attack_id_pattern
    value: ^T\d{4}(\.\d{3})?$
description: 'A technique: how an adversary achieves a tactic''s goal. Its ATT&CK
  ID is T and four digits, and a sub-technique''s adds a full stop and three digits.'
comments:
- A sub-technique is a technique too, with x_mitre_is_subtechnique set and a subtechnique-of
  relationship to its parent.
from_schema: https://w3id.org/lmodel/attack
is_a: StixAttackPattern
slots:
- x_mitre_attack_spec_version
- x_mitre_version
- x_mitre_deprecated
- x_mitre_old_attack_id
- x_mitre_domains
- x_mitre_modified_by_ref
- x_mitre_contributors
- x_mitre_platforms
- x_mitre_is_subtechnique
- x_mitre_impact_type
- x_mitre_network_requirements
- x_mitre_tactic_type
- x_mitre_detection
- x_mitre_data_sources
- x_mitre_defense_bypassed
- x_mitre_permissions_required
- x_mitre_effective_permissions
- x_mitre_system_requirements
- x_mitre_remote_support
slot_usage:
  external_references:
    name: external_references
    required: true
  kill_chain_phases:
    name: kill_chain_phases
    range: AttackKillChainPhase
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    required: true
  x_mitre_version:
    name: x_mitre_version
    required: true
  x_mitre_domains:
    name: x_mitre_domains
    required: true
  x_mitre_is_subtechnique:
    name: x_mitre_is_subtechnique
    required: true

Induced

Section titled “Induced”
name: AttackTechnique
annotations:
  stix_type:
    tag: stix_type
    value: attack-pattern
  attack_id_pattern:
    tag: attack_id_pattern
    value: ^T\d{4}(\.\d{3})?$
description: 'A technique: how an adversary achieves a tactic''s goal. Its ATT&CK
  ID is T and four digits, and a sub-technique''s adds a full stop and three digits.'
comments:
- A sub-technique is a technique too, with x_mitre_is_subtechnique set and a subtechnique-of
  relationship to its parent.
from_schema: https://w3id.org/lmodel/attack
is_a: StixAttackPattern
slot_usage:
  external_references:
    name: external_references
    required: true
  kill_chain_phases:
    name: kill_chain_phases
    range: AttackKillChainPhase
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    required: true
  x_mitre_version:
    name: x_mitre_version
    required: true
  x_mitre_domains:
    name: x_mitre_domains
    required: true
  x_mitre_is_subtechnique:
    name: x_mitre_is_subtechnique
    required: true
attributes:
  x_mitre_attack_spec_version:
    name: x_mitre_attack_spec_version
    description: The version of the ATT&CK specification the object follows, as MAJOR.MINOR.PATCH.
      Without it, an object is read as version 2.0.0.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_attack_spec_version
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    - AttackIdentity
    range: string
    required: true
    pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$
  x_mitre_version:
    name: x_mitre_version
    description: The version of the object's content, as MAJOR.MINOR with each number
      between 0 and 99. ATT&CK raises it when the content changes.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_version
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    range: string
    required: true
    pattern: ^\d{1,2}\.\d{1,2}$
  x_mitre_deprecated:
    name: x_mitre_deprecated
    description: Whether ATT&CK has deprecated the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_deprecated
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    - AttackIdentity
    range: boolean
  x_mitre_old_attack_id:
    name: x_mitre_old_attack_id
    description: An ATT&CK ID the object had before Mobile ATT&CK's objects were renumbered,
      such as MOB-S0012.
    deprecated: The ADM v4.11.7 marks it as deprecated, a legacy of the Mobile IDs
      that current ATT&CK IDs replaced, and names no release that removes it.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_old_attack_id
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    - AttackIdentity
    range: string
    pattern: ^MOB-(M|S)\d{4}$
  x_mitre_domains:
    name: x_mitre_domains
    description: The ATT&CK domains the object belongs to.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_domains
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    range: AttackDomain
    required: true
    multivalued: true
    minimum_cardinality: 1
  x_mitre_modified_by_ref:
    name: x_mitre_modified_by_ref
    description: 'The identity that made the current version of the object: always
      The MITRE Corporation''s. Earlier versions may have had other authors.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_modified_by_ref
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelationship
    range: StixIdentity
    pattern: ^identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5$
  x_mitre_contributors:
    name: x_mitre_contributors
    description: The people and organizations who contributed to the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_contributors
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    - AttackTactic
    - AttackGroup
    - AttackCampaign
    - AttackMalware
    - AttackTool
    - AttackMitigation
    - AttackAsset
    - AttackDataSource
    - AttackDetectionStrategy
    range: string
    multivalued: true
    pattern: \S
    minimum_cardinality: 1
  x_mitre_platforms:
    name: x_mitre_platforms
    description: The platforms the object applies to, each named once.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_platforms
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    - AttackMalware
    - AttackTool
    - AttackAsset
    - AttackDataSource
    - AttackAnalytic
    range: AttackPlatform
    multivalued: true
    minimum_cardinality: 1
  x_mitre_is_subtechnique:
    name: x_mitre_is_subtechnique
    description: Whether the technique is a sub-technique of another.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_is_subtechnique
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: boolean
    required: true
  x_mitre_impact_type:
    name: x_mitre_impact_type
    annotations:
      attack_domains:
        tag: attack_domains
        value: enterprise-attack
      attack_tactic:
        tag: attack_tactic
        value: impact
    description: Whether an impact technique attacks integrity, availability or both.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_impact_type
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: AttackImpactType
    multivalued: true
    minimum_cardinality: 1
  x_mitre_network_requirements:
    name: x_mitre_network_requirements
    description: Whether the technique needs a network to run.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_network_requirements
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: boolean
  x_mitre_tactic_type:
    name: x_mitre_tactic_type
    annotations:
      attack_domains:
        tag: attack_domains
        value: mobile-attack
    description: Whether a Mobile technique needs access to the device.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_tactic_type
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: AttackTacticType
    multivalued: true
    minimum_cardinality: 1
  x_mitre_detection:
    name: x_mitre_detection
    description: How to tell that the technique has been used.
    deprecated: The ADM deprecates it in ATT&CK specification 3.3.0 and removes it
      in 4.0.0; detection strategies and analytics take its place.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_detection
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: string
    pattern: \S
  x_mitre_data_sources:
    name: x_mitre_data_sources
    annotations:
      attack_excluded_domains:
        tag: attack_excluded_domains
        value: mobile-attack
    description: 'The data that can reveal the technique, each as "Data Source Name:
      Data Component Name".'
    deprecated: The ADM deprecates it in ATT&CK specification 3.3.0 and removes it
      in 4.0.0; detection strategies and analytics take its place.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_data_sources
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: string
    multivalued: true
    pattern: ^\s*[^:\s][^:]*:\s*[^:\s][^:]*$
    minimum_cardinality: 1
  x_mitre_defense_bypassed:
    name: x_mitre_defense_bypassed
    annotations:
      attack_domains:
        tag: attack_domains
        value: enterprise-attack
      attack_tactic:
        tag: attack_tactic
        value: defense-evasion
    description: The defenses a defense-evasion technique can get past.
    deprecated: The ADM deprecates it in ATT&CK specification 3.3.0 and removes it
      in 4.0.0.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_defense_bypassed
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: AttackBypassedDefense
    multivalued: true
    minimum_cardinality: 1
  x_mitre_permissions_required:
    name: x_mitre_permissions_required
    annotations:
      attack_domains:
        tag: attack_domains
        value: enterprise-attack
      attack_tactic:
        tag: attack_tactic
        value: privilege-escalation
    description: The lowest level of permission a privilege-escalation technique needs
      on a system.
    deprecated: The ADM deprecates it in ATT&CK specification 3.3.0 and removes it
      in 4.0.0.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_permissions_required
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: AttackRequiredPermission
    multivalued: true
    minimum_cardinality: 1
  x_mitre_effective_permissions:
    name: x_mitre_effective_permissions
    annotations:
      attack_domains:
        tag: attack_domains
        value: enterprise-attack
      attack_tactic:
        tag: attack_tactic
        value: privilege-escalation
    description: The level of permission a privilege-escalation technique gains.
    deprecated: The ADM deprecates it in ATT&CK specification 3.3.0 and removes it
      in 4.0.0.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_effective_permissions
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: AttackEffectivePermission
    multivalued: true
    minimum_cardinality: 1
  x_mitre_system_requirements:
    name: x_mitre_system_requirements
    annotations:
      attack_domains:
        tag: attack_domains
        value: enterprise-attack
    description: What the system must have or be, such as software or a patch level,
      for the technique to work.
    deprecated: The ADM deprecates it in ATT&CK specification 3.3.0 and removes it
      in 4.0.0.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_system_requirements
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: string
    multivalued: true
    pattern: \S
    minimum_cardinality: 1
  x_mitre_remote_support:
    name: x_mitre_remote_support
    annotations:
      attack_domains:
        tag: attack_domains
        value: enterprise-attack
      attack_tactic:
        tag: attack_tactic
        value: execution
    description: Whether an execution technique can run something on a remote system.
    deprecated: The ADM deprecates it in ATT&CK specification 3.3.0 and removes it
      in 4.0.0.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: attack:x_mitre_remote_support
    owner: AttackTechnique
    domain_of:
    - AttackTechnique
    range: boolean
  aliases:
    name: aliases
    description: Other names by which the object is known.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:aliases
    owner: AttackTechnique
    domain_of:
    - StixAttackPattern
    - StixCampaign
    - StixInfrastructure
    - StixIntrusionSet
    - StixMalware
    - StixThreatActor
    - StixTool
    range: string
    multivalued: true
    minimum_cardinality: 1
  name:
    name: name
    description: A name that identifies the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:name
    rank: 1000
    slot_uri: stix:name
    owner: AttackTechnique
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackDetectionStrategy
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackLogSource
    - AttackLogSourceReference
    - StixIdentity
    - StixMarkingDefinition
    - StixExtensionDefinition
    - StixAutonomousSystem
    - StixFile
    - StixMutex
    - StixSoftware
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsRegistryValue
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    range: string
    required: true
  description:
    name: description
    description: A description of the object, which may be long.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:description
    rank: 1000
    slot_uri: stix:description
    owner: AttackTechnique
    domain_of:
    - AttackTactic
    - AttackMatrix
    - AttackCollection
    - AttackAsset
    - AttackDataSource
    - AttackDataComponent
    - AttackAnalytic
    - AttackRelatedAsset
    - AttackMutableElement
    - StixIdentity
    - StixExtensionDefinition
    - StixExternalReference
    - StixAttackPattern
    - StixCampaign
    - StixCourseOfAction
    - StixGrouping
    - StixIncident
    - StixIndicator
    - StixInfrastructure
    - StixIntrusionSet
    - StixLocation
    - StixMalware
    - StixReport
    - StixThreatActor
    - StixTool
    - StixVulnerability
    - StixRelationship
    - StixSighting
    range: string
  kill_chain_phases:
    name: kill_chain_phases
    description: The kill chain phases to which the object corresponds.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:kill_chain_phases
    owner: AttackTechnique
    domain_of:
    - StixAttackPattern
    - StixIndicator
    - StixInfrastructure
    - StixMalware
    - StixTool
    range: AttackKillChainPhase
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  created_by_ref:
    name: created_by_ref
    description: A reference to the identity of the object's creator.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:createdBy
    rank: 1000
    slot_uri: stix:created_by_ref
    owner: AttackTechnique
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixIdentity
    pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  created:
    name: created
    description: The time at which the object, or its first version, was created.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectCreatedTime
    rank: 1000
    slot_uri: stix:created
    owner: AttackTechnique
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: stix_timestamp_millis
    required: true
  modified:
    name: modified
    description: The time at which this version of the object was modified.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:modifiedTime
    rank: 1000
    slot_uri: stix:modified
    owner: AttackTechnique
    domain_of:
    - StixCommonObject
    range: stix_timestamp_millis
    required: true
  revoked:
    name: revoked
    description: The revoked property indicates whether the object has been revoked.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:revoked
    owner: AttackTechnique
    domain_of:
    - StixCommonObject
    range: boolean
  labels:
    name: labels
    description: The labels property specifies a set of terms used to describe this
      object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:tag
    rank: 1000
    slot_uri: stix:labels
    owner: AttackTechnique
    domain_of:
    - StixCommonObject
    range: string
    multivalued: true
    minimum_cardinality: 1
  confidence:
    name: confidence
    description: Identifies the confidence that the creator has in the correctness
      of their data.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:confidence
    rank: 1000
    slot_uri: stix:confidence
    owner: AttackTechnique
    domain_of:
    - StixCommonObject
    range: integer
    minimum_value: 0
    maximum_value: 100
  lang:
    name: lang
    description: The language of the text content, as an RFC 5646 language code.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:lang
    owner: AttackTechnique
    domain_of:
    - StixCommonObject
    - StixGranularMarking
    range: string
  external_references:
    name: external_references
    description: References to non-STIX information about the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:externalReference
    rank: 1000
    slot_uri: stix:external_references
    owner: AttackTechnique
    domain_of:
    - StixCommonObject
    - StixMarkingDefinition
    range: StixExternalReference
    required: true
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  id:
    name: id
    description: 'The identifier of the object: its STIX type, two hyphens and a UUID.
      Each class narrows the type.'
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:id
    identifier: true
    owner: AttackTechnique
    domain_of:
    - StixObject
    - StixBundle
    range: stix_identifier
    required: true
    pattern: ^attack-pattern--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
  type:
    name: type
    description: The STIX type name of the object, such as attack-pattern. Each class
      pins its own.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:type
    owner: AttackTechnique
    domain_of:
    - StixObject
    - StixBundle
    range: string
    required: true
    pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$
    equals_string: attack-pattern
  spec_version:
    name: spec_version
    description: The version of the STIX specification used to represent the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:spec_version
    owner: AttackTechnique
    domain_of:
    - StixObject
    range: StixSpecVersion
    required: true
  object_marking_refs:
    name: object_marking_refs
    description: References to the marking definitions that apply to the object.
    from_schema: https://w3id.org/lmodel/attack
    close_mappings:
    - uco-core:objectMarking
    rank: 1000
    slot_uri: stix:object_marking_refs
    owner: AttackTechnique
    domain_of:
    - StixObject
    range: StixMarkingDefinition
    multivalued: true
    pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    minimum_cardinality: 1
  granular_markings:
    name: granular_markings
    description: The granular markings that apply to parts of the object.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:granular_markings
    owner: AttackTechnique
    domain_of:
    - StixObject
    range: StixGranularMarking
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  extensions:
    name: extensions
    description: The object's extensions, as a dictionary keyed by extension name.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:extensions
    owner: AttackTechnique
    domain_of:
    - StixObject
    range: StixExtensions
    inlined: true