Class: AttackTool
A tool: software, often legitimate, that an adversary uses, such as a penetration-testing or administration tool. ATT&CK counts it as software, with an ATT&CK ID of S and four digits.
URI: attack:AttackTool
classDiagram
class AttackTool
click AttackTool href "../AttackTool/"
StixTool <|-- AttackTool
click StixTool href "../StixTool/"
AttackTool : aliases
AttackTool : confidence
AttackTool : created
AttackTool : created_by_ref
AttackTool --> "1" StixIdentity : created_by_ref
click StixIdentity href "../StixIdentity/"
AttackTool : description
AttackTool : extensions
AttackTool --> "0..1" StixExtensions : extensions
click StixExtensions href "../StixExtensions/"
AttackTool : external_references
AttackTool --> "1..*" StixExternalReference : external_references
click StixExternalReference href "../StixExternalReference/"
AttackTool : granular_markings
AttackTool --> "1..*" StixGranularMarking : granular_markings
click StixGranularMarking href "../StixGranularMarking/"
AttackTool : id
AttackTool : kill_chain_phases
AttackTool --> "1..*" StixKillChainPhase : kill_chain_phases
click StixKillChainPhase href "../StixKillChainPhase/"
AttackTool : labels
AttackTool : lang
AttackTool : modified
AttackTool : name
AttackTool : object_marking_refs
AttackTool --> "1..*" StixMarkingDefinition : object_marking_refs
click StixMarkingDefinition href "../StixMarkingDefinition/"
AttackTool : revoked
AttackTool : spec_version
AttackTool --> "1" StixSpecVersion : spec_version
click StixSpecVersion href "../StixSpecVersion/"
AttackTool : tool_types
AttackTool : tool_version
AttackTool : type
AttackTool : x_mitre_aliases
AttackTool : x_mitre_attack_spec_version
AttackTool : x_mitre_contributors
AttackTool : x_mitre_deprecated
AttackTool : x_mitre_domains
AttackTool --> "1..*" AttackDomain : x_mitre_domains
click AttackDomain href "../AttackDomain/"
AttackTool : x_mitre_modified_by_ref
AttackTool --> "1" StixIdentity : x_mitre_modified_by_ref
click StixIdentity href "../StixIdentity/"
AttackTool : x_mitre_old_attack_id
AttackTool : x_mitre_platforms
AttackTool --> "1..*" AttackPlatform : x_mitre_platforms
click AttackPlatform href "../AttackPlatform/"
AttackTool : x_mitre_version
Inheritance
Section titled “Inheritance”- StixObject
- StixCommonObject
- StixDomainObject
- StixTool
- AttackTool
- StixTool
- StixDomainObject
- StixCommonObject
| Name | Cardinality and Range | Description | Inheritance |
|---|---|---|---|
| x_mitre_attack_spec_version | 1 String |
The version of the ATT&CK specification the object follows, as MAJOR | direct |
| x_mitre_version | 1 String |
The version of the object’s content, as MAJOR | direct |
| x_mitre_deprecated | 0..1 Boolean |
Whether ATT&CK has deprecated the object | direct |
| x_mitre_old_attack_id | 0..1 String |
An ATT&CK ID the object had before Mobile ATT&CK’s objects were renumbered, s… | direct |
| x_mitre_domains | 1..* AttackDomain |
The ATT&CK domains the object belongs to | direct |
| x_mitre_modified_by_ref | 1 StixIdentity |
The identity that made the current version of the object: always The MITRE Co… | direct |
| x_mitre_contributors | 1..* String |
The people and organizations who contributed to the object | direct |
| x_mitre_platforms | 1..* AttackPlatform |
The platforms the object applies to, each named once | direct |
| x_mitre_aliases | 1..* String |
Other names of a piece of software | direct |
| aliases | 1..* String |
Other names by which the object is known | StixTool |
| tool_types | 1..* String or StixToolType |
The kinds of tool, such as remote-access | StixTool |
| name | 1 String |
A name that identifies the object | StixTool |
| description | 1 String |
A description of the object, which may be long | StixTool |
| tool_version | 0..1 String |
The version identifier associated with the tool | StixTool |
| kill_chain_phases | 1..* StixKillChainPhase |
The kill chain phases to which the object corresponds | StixTool |
| created_by_ref | 1 StixIdentity |
A reference to the identity of the object’s creator | StixCommonObject |
| created | 1 StixTimestampMillis |
The time at which the object, or its first version, was created | StixCommonObject |
| modified | 1 StixTimestampMillis |
The time at which this version of the object was modified | StixCommonObject |
| revoked | 0..1 Boolean |
The revoked property indicates whether the object has been revoked | StixCommonObject |
| labels | 1..* String |
The labels property specifies a set of terms used to describe this object | StixCommonObject |
| confidence | 0..1 Integer |
Identifies the confidence that the creator has in the correctness of their da… | StixCommonObject |
| lang | 0..1 String |
The language of the text content, as an RFC 5646 language code | StixCommonObject |
| external_references | 1..* StixExternalReference |
References to non-STIX information about the object | StixCommonObject |
| id | 1 StixIdentifier |
The identifier of the object: its STIX type, two hyphens and a UUID | StixObject |
| type | 1 String |
The STIX type name of the object, such as attack-pattern | StixObject |
| spec_version | 1 StixSpecVersion |
The version of the STIX specification used to represent the object | StixObject |
| object_marking_refs | 1..* StixMarkingDefinition |
References to the marking definitions that apply to the object | StixObject |
| granular_markings | 1..* StixGranularMarking |
The granular markings that apply to parts of the object | StixObject |
| extensions | 0..1 StixExtensions |
The object’s extensions, as a dictionary keyed by extension name | StixObject |
Identifier and Mapping Information
Section titled “Identifier and Mapping Information”Annotations
Section titled “Annotations”| property | value |
|---|---|
| stix_type | tool |
| attack_id_pattern | ^S\d{4}$ |
Schema Source
Section titled “Schema Source”- from schema: https://w3id.org/lmodel/attack
Mappings
Section titled “Mappings”| Mapping Type | Mapped Value |
|---|---|
| self | attack:AttackTool |
| native | attack:AttackTool |
LinkML Source
Section titled “LinkML Source”Direct
Section titled “Direct”name: AttackToolannotations: stix_type: tag: stix_type value: tool attack_id_pattern: tag: attack_id_pattern value: ^S\d{4}$description: 'A tool: software, often legitimate, that an adversary uses, such as a penetration-testing or administration tool. ATT&CK counts it as software, with an ATT&CK ID of S and four digits.'from_schema: https://w3id.org/lmodel/attackis_a: StixToolslots:- x_mitre_attack_spec_version- x_mitre_version- x_mitre_deprecated- x_mitre_old_attack_id- x_mitre_domains- x_mitre_modified_by_ref- x_mitre_contributors- x_mitre_platforms- x_mitre_aliasesslot_usage: created_by_ref: name: created_by_ref required: true description: name: description required: true external_references: name: external_references required: true x_mitre_attack_spec_version: name: x_mitre_attack_spec_version required: true x_mitre_version: name: x_mitre_version required: true x_mitre_domains: name: x_mitre_domains required: true x_mitre_modified_by_ref: name: x_mitre_modified_by_ref required: true x_mitre_old_attack_id: name: x_mitre_old_attack_id pattern: ^MOB-S\d{4}$Induced
Section titled “Induced”name: AttackToolannotations: stix_type: tag: stix_type value: tool attack_id_pattern: tag: attack_id_pattern value: ^S\d{4}$description: 'A tool: software, often legitimate, that an adversary uses, such as a penetration-testing or administration tool. ATT&CK counts it as software, with an ATT&CK ID of S and four digits.'from_schema: https://w3id.org/lmodel/attackis_a: StixToolslot_usage: created_by_ref: name: created_by_ref required: true description: name: description required: true external_references: name: external_references required: true x_mitre_attack_spec_version: name: x_mitre_attack_spec_version required: true x_mitre_version: name: x_mitre_version required: true x_mitre_domains: name: x_mitre_domains required: true x_mitre_modified_by_ref: name: x_mitre_modified_by_ref required: true x_mitre_old_attack_id: name: x_mitre_old_attack_id pattern: ^MOB-S\d{4}$attributes: x_mitre_attack_spec_version: name: x_mitre_attack_spec_version description: The version of the ATT&CK specification the object follows, as MAJOR.MINOR.PATCH. Without it, an object is read as version 2.0.0. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_attack_spec_version owner: AttackTool domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelationship - AttackIdentity range: string required: true pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$ x_mitre_version: name: x_mitre_version description: The version of the object's content, as MAJOR.MINOR with each number between 0 and 99. ATT&CK raises it when the content changes. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_version owner: AttackTool domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic range: string required: true pattern: ^\d{1,2}\.\d{1,2}$ x_mitre_deprecated: name: x_mitre_deprecated description: Whether ATT&CK has deprecated the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_deprecated owner: AttackTool domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelationship - AttackIdentity range: boolean x_mitre_old_attack_id: name: x_mitre_old_attack_id description: An ATT&CK ID the object had before Mobile ATT&CK's objects were renumbered, such as MOB-S0012. deprecated: The ADM v4.11.7 marks it as deprecated, a legacy of the Mobile IDs that current ATT&CK IDs replaced, and names no release that removes it. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_old_attack_id owner: AttackTool domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelationship - AttackIdentity range: string pattern: ^MOB-S\d{4}$ x_mitre_domains: name: x_mitre_domains description: The ATT&CK domains the object belongs to. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_domains owner: AttackTool domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic range: AttackDomain required: true multivalued: true minimum_cardinality: 1 x_mitre_modified_by_ref: name: x_mitre_modified_by_ref description: 'The identity that made the current version of the object: always The MITRE Corporation''s. Earlier versions may have had other authors.' from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_modified_by_ref owner: AttackTool domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelationship range: StixIdentity required: true pattern: ^identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5$ x_mitre_contributors: name: x_mitre_contributors description: The people and organizations who contributed to the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_contributors owner: AttackTool domain_of: - AttackTechnique - AttackTactic - AttackGroup - AttackCampaign - AttackMalware - AttackTool - AttackMitigation - AttackAsset - AttackDataSource - AttackDetectionStrategy range: string multivalued: true pattern: \S minimum_cardinality: 1 x_mitre_platforms: name: x_mitre_platforms description: The platforms the object applies to, each named once. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_platforms owner: AttackTool domain_of: - AttackTechnique - AttackMalware - AttackTool - AttackAsset - AttackDataSource - AttackAnalytic range: AttackPlatform multivalued: true minimum_cardinality: 1 x_mitre_aliases: name: x_mitre_aliases description: Other names of a piece of software. The first is the software's own name. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: attack:x_mitre_aliases owner: AttackTool domain_of: - AttackMalware - AttackTool range: string multivalued: true pattern: \S minimum_cardinality: 1 aliases: name: aliases description: Other names by which the object is known. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:aliases owner: AttackTool domain_of: - StixAttackPattern - StixCampaign - StixInfrastructure - StixIntrusionSet - StixMalware - StixThreatActor - StixTool range: string multivalued: true minimum_cardinality: 1 tool_types: name: tool_types description: The kinds of tool, such as remote-access. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:tool_types owner: AttackTool domain_of: - StixTool range: string multivalued: true minimum_cardinality: 1 any_of: - range: StixToolType - range: string name: name: name description: A name that identifies the object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:name rank: 1000 slot_uri: stix:name owner: AttackTool domain_of: - AttackTactic - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackDetectionStrategy - AttackAnalytic - AttackRelatedAsset - AttackLogSource - AttackLogSourceReference - StixIdentity - StixMarkingDefinition - StixExtensionDefinition - StixAutonomousSystem - StixFile - StixMutex - StixSoftware - StixAlternateDataStream - StixWindowsPeSection - StixWindowsRegistryValue - StixAttackPattern - StixCampaign - StixCourseOfAction - StixGrouping - StixIncident - StixIndicator - StixInfrastructure - StixIntrusionSet - StixLocation - StixMalware - StixReport - StixThreatActor - StixTool - StixVulnerability range: string required: true description: name: description description: A description of the object, which may be long. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:description rank: 1000 slot_uri: stix:description owner: AttackTool domain_of: - AttackTactic - AttackMatrix - AttackCollection - AttackAsset - AttackDataSource - AttackDataComponent - AttackAnalytic - AttackRelatedAsset - AttackMutableElement - StixIdentity - StixExtensionDefinition - StixExternalReference - StixAttackPattern - StixCampaign - StixCourseOfAction - StixGrouping - StixIncident - StixIndicator - StixInfrastructure - StixIntrusionSet - StixLocation - StixMalware - StixReport - StixThreatActor - StixTool - StixVulnerability - StixRelationship - StixSighting range: string required: true tool_version: name: tool_version description: The version identifier associated with the tool. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:tool_version owner: AttackTool domain_of: - StixTool range: string kill_chain_phases: name: kill_chain_phases description: The kill chain phases to which the object corresponds. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:kill_chain_phases owner: AttackTool domain_of: - StixAttackPattern - StixIndicator - StixInfrastructure - StixMalware - StixTool range: StixKillChainPhase multivalued: true inlined: true inlined_as_list: true minimum_cardinality: 1 created_by_ref: name: created_by_ref description: A reference to the identity of the object's creator. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:createdBy rank: 1000 slot_uri: stix:created_by_ref owner: AttackTool domain_of: - StixCommonObject - StixMarkingDefinition range: StixIdentity required: true pattern: ^identity--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ created: name: created description: The time at which the object, or its first version, was created. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:objectCreatedTime rank: 1000 slot_uri: stix:created owner: AttackTool domain_of: - StixCommonObject - StixMarkingDefinition range: stix_timestamp_millis required: true modified: name: modified description: The time at which this version of the object was modified. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:modifiedTime rank: 1000 slot_uri: stix:modified owner: AttackTool domain_of: - StixCommonObject range: stix_timestamp_millis required: true revoked: name: revoked description: The revoked property indicates whether the object has been revoked. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:revoked owner: AttackTool domain_of: - StixCommonObject range: boolean labels: name: labels description: The labels property specifies a set of terms used to describe this object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:tag rank: 1000 slot_uri: stix:labels owner: AttackTool domain_of: - StixCommonObject range: string multivalued: true minimum_cardinality: 1 confidence: name: confidence description: Identifies the confidence that the creator has in the correctness of their data. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:confidence rank: 1000 slot_uri: stix:confidence owner: AttackTool domain_of: - StixCommonObject range: integer minimum_value: 0 maximum_value: 100 lang: name: lang description: The language of the text content, as an RFC 5646 language code. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:lang owner: AttackTool domain_of: - StixCommonObject - StixGranularMarking range: string external_references: name: external_references description: References to non-STIX information about the object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:externalReference rank: 1000 slot_uri: stix:external_references owner: AttackTool domain_of: - StixCommonObject - StixMarkingDefinition range: StixExternalReference required: true multivalued: true inlined: true inlined_as_list: true minimum_cardinality: 1 id: name: id description: 'The identifier of the object: its STIX type, two hyphens and a UUID. Each class narrows the type.' from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:id identifier: true owner: AttackTool domain_of: - StixObject - StixBundle range: stix_identifier required: true pattern: ^tool--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ type: name: type description: The STIX type name of the object, such as attack-pattern. Each class pins its own. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:type owner: AttackTool domain_of: - StixObject - StixBundle range: string required: true pattern: ^([a-z][a-z0-9]*)+(-[a-z0-9]+)*\-?$ equals_string: tool spec_version: name: spec_version description: The version of the STIX specification used to represent the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:spec_version owner: AttackTool domain_of: - StixObject range: StixSpecVersion required: true object_marking_refs: name: object_marking_refs description: References to the marking definitions that apply to the object. from_schema: https://w3id.org/lmodel/attack close_mappings: - uco-core:objectMarking rank: 1000 slot_uri: stix:object_marking_refs owner: AttackTool domain_of: - StixObject range: StixMarkingDefinition multivalued: true pattern: ^marking-definition--[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$ minimum_cardinality: 1 granular_markings: name: granular_markings description: The granular markings that apply to parts of the object. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:granular_markings owner: AttackTool domain_of: - StixObject range: StixGranularMarking multivalued: true inlined: true inlined_as_list: true minimum_cardinality: 1 extensions: name: extensions description: The object's extensions, as a dictionary keyed by extension name. from_schema: https://w3id.org/lmodel/attack rank: 1000 slot_uri: stix:extensions owner: AttackTool domain_of: - StixObject range: StixExtensions inlined: true